CVE-2016-1594

Published: Apr 22, 2016Modified: May 6, 2026

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated by obtaining sensitive information via a (1) downloadLogFiles or (2) downloadFile action.

Affected (1)

Products: Novell: Service Desk

Novell

1 product

Service Desk

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Novell Service Desk	Up to 7.1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (10)

http://www.securityfocus.com/archive/1/538043/100/0/threaded

Source: security@opentext.com

https://packetstormsecurity.com/files/136646

Source: security@opentext.com

https://raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txt

Source: security@opentext.com

https://www.exploit-db.com/exploits/39687/

Source: security@opentext.com

https://www.novell.com/support/kb/doc.php?id=7017429

Source: security@opentext.com

http://www.securityfocus.com/archive/1/538043/100/0/threaded