Medium severity6.5NVD Advisory· Published Apr 22, 2016· Updated May 6, 2026

CVE-2016-1594

Description

Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa URL, as demonstrated by obtaining sensitive information via a (1) downloadLogFiles or (2) downloadFile action.

Affected products

Novell/Service Desk
cpe:2.3:a:novell:service_desk:*:*:*:*:*:*:*:*
Range: <=7.1

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

www.securityfocus.com/archive/1/538043/100/0/threadednvd
packetstormsecurity.com/files/136646nvd
raw.githubusercontent.com/pedrib/PoC/master/advisories/novell-service-desk-7.1.0.txtnvd
www.exploit-db.com/exploits/39687/nvd
www.novell.com/support/kb/doc.phpnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.004
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000