Medium severity · published May 22, 2025
CVE-2025-3444
Local File Inclusion
6.5
CVSS
1.6%
EPSS
No
On KEV
Description
Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
ServiceDesk Plus MSP · ManageEngine
before 14920 · source: vendor
SP
SupportCenter Plus · ManageEngine
before 14920 · source: vendor
MS
Manageengine Servicedesk Plus Msp · Zohocorp
through 14.8; 14.9; 14.9 · source: NVD
MS
Manageengine Supportcenter Plus · Zohocorp
through 14.8; 14.9; 14.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-3444
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-3444
Vendor Advisory
https://www.manageengine.com/products/service-desk-msp/cve-2025-3444.html
More from ServiceDesk Plus MSP
8.1
CVE-2025-8309
User privilege escalation vulnerability
6.1
CVE-2024-41150
An Stored Cross-site Scripting vulnerability in request module affects Zohocorp ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus.This issue affects ServiceDesk Plus versions:
5.4
CVE-2024-50053
Zohocorp ManageEngine ServiceDesk Plus versions below 14920 , ServiceDesk Plus MSP and SupportCentre Plus versions below 14910 are vulnerable to Stored XSS in the task feature.