CVE-2025-3444: 
Zoho ManageEngine SupportCenter Plus vulnerability analysis and mitigation

Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded. The vulnerability was discovered by Esther through ManageEngine's bug bounty portal and was fixed on April 10, 2025 (ManageEngine Advisory).

The vulnerability exists in the Admin module where help card content is loaded without proper validation, allowing authenticated technicians to perform Local File Inclusion. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The weakness has been classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) (NVD Database).

The vulnerability allows authenticated technicians to read any file added to the installation folder from the web server, potentially exposing sensitive information (ManageEngine Advisory).

The vulnerability requires authentication and low privileges to exploit. The attack vector is network-based with low attack complexity and requires no user interaction (Wiz Database).

The issue has been resolved in version 14920 by implementing proper validation of the file path. Users are advised to upgrade to the latest service pack available for both ServiceDesk Plus MSP and SupportCenter Plus. The upgrade process involves downloading and applying the latest build to the existing product installation (ManageEngine Advisory).