Unscored severity · published Sep 20, 2011
CVE-2011-1509
The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier…
–
CVSS
0.8%
EPSS
No
On KEV
Description
The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Servicedesk Plus · Manageengine
through 8012; 8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1509
securityreason.com
http://securityreason.com/securityalert/8385
www.coresecurity.com
http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp
www.securityfocus.com
http://www.securityfocus.com/archive/1/519652/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/49636
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/69841
More from Servicedesk Plus
8.8
CVE-2014-5302
Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4 allows remote…
8.8
CVE-2014-5301
Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4
8.1
CVE-2025-8309
User privilege escalation vulnerability
6.1
CVE-2008-1299
Cross-site scripting (XSS) vulnerability in SolutionSearch.do in ManageEngine ServiceDesk Plus 7.0.0 Build 7011 for Windows allows remote attackers to inject arbitrary web script…
5.4
CVE-2024-50053
Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature.