Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2025-8309

There is an improper privilege management vulnerability identified in ManageEngine's Asset Explorer, ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus products by Zohocorp. This vulnerability impacts Asset Explorer versions before 7710, ServiceDesk Plus versions before 15110, ServiceDesk Plus MSP versions before 14940, and SupportCenter Plus versions before 14940.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:9ae3073e54d14c1611525fbce2ce93c07fc17441f1bf8a5b4c64b52f5d6ec113
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 4 assertions

{"defaultStatus":"unaffected","product":"SupportCenter Plus","vendor":"ManageEngine","versions":[{"lessThan":"14940","status":"affected","version":"0","versionType":"14940"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0cfad972d2f46a9aa490a8ccd9bb36b3382913ff638f65d9237cc2f3f09af70a · sha256:02d08c3283bf9579… · /containers/cna/affected/3

{"defaultStatus":"unaffected","product":"Asset Explorer","vendor":"ManageEngine","versions":[{"lessThan":"7710","status":"affected","version":"0","versionType":"7710"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0cfad972d2f46a9aa490a8ccd9bb36b3382913ff638f65d9237cc2f3f09af70a · sha256:02d08c3283bf9579… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"ServiceDesk Plus MSP","vendor":"ManageEngine","versions":[{"lessThan":"14940","status":"affected","version":"0","versionType":"14940"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0cfad972d2f46a9aa490a8ccd9bb36b3382913ff638f65d9237cc2f3f09af70a · sha256:02d08c3283bf9579… · /containers/cna/affected/2

{"defaultStatus":"unaffected","product":"ServiceDesk Plus","vendor":"ManageEngine","versions":[{"lessThan":"15110","status":"affected","version":"0","versionType":"15110"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0cfad972d2f46a9aa490a8ccd9bb36b3382913ff638f65d9237cc2f3f09af70a · sha256:02d08c3283bf9579… · /containers/cna/affected/1

Affected products and versions

4 source assertions
{"defaultStatus":"unaffected","product":"SupportCenter Plus","vendor":"ManageEngine","versions":[{"lessThan":"14940","status":"affected","version":"0","versionType":"14940"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0cfad972d2f46a9aa490a8ccd9bb36b3382913ff638f65d9237cc2f3f09af70a · sha256:02d08c3283bf9579… · /containers/cna/affected/3
{"defaultStatus":"unaffected","product":"Asset Explorer","vendor":"ManageEngine","versions":[{"lessThan":"7710","status":"affected","version":"0","versionType":"7710"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0cfad972d2f46a9aa490a8ccd9bb36b3382913ff638f65d9237cc2f3f09af70a · sha256:02d08c3283bf9579… · /containers/cna/affected/0
{"defaultStatus":"unaffected","product":"ServiceDesk Plus MSP","vendor":"ManageEngine","versions":[{"lessThan":"14940","status":"affected","version":"0","versionType":"14940"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0cfad972d2f46a9aa490a8ccd9bb36b3382913ff638f65d9237cc2f3f09af70a · sha256:02d08c3283bf9579… · /containers/cna/affected/2
{"defaultStatus":"unaffected","product":"ServiceDesk Plus","vendor":"ManageEngine","versions":[{"lessThan":"15110","status":"affected","version":"0","versionType":"15110"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0cfad972d2f46a9aa490a8ccd9bb36b3382913ff638f65d9237cc2f3f09af70a · sha256:02d08c3283bf9579… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:0cfad972d2f46a9aa490a8ccd9bb36b3382913ff638f65d9237cc2f3f09af70a · sha256:02d08c3283bf9579… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-269","description":"CWE-269 Improper Privilege Management","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:0cfad972d2f46a9aa490a8ccd9bb36b3382913ff638f65d9237cc2f3f09af70a · sha256:02d08c3283bf9579… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"url":"https://www.manageengine.com/products/service-desk/cve-2025-8309.html"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0cfad972d2f46a9aa490a8ccd9bb36b3382913ff638f65d9237cc2f3f09af70a · sha256:02d08c3283bf9579… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer