9.8Kritisch
KEV
CVE-2020-10189Zoho ManageEngine Desktop Central File Upload Vulnerability
Bekannt ausgenutzt — Zoho ManageEngine Desktop Central File Upload Vulnerability
CISA hat am 03.11.2021 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 03.05.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-10189
Beschreibung
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
Schwachstellentyp (CWE):
CWE-502
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| zohocorp | manageengine desktop central | < 10.0.479 |
Referenzen und Patches
- https://srcincite.io/advisories/src-2020-0011/ ExploitThird Party Advisory
- https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/ Third Party Advisory
- https://srcincite.io/pocs/src-2020-0011.py.txt ExploitThird Party Advisory
- https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html Vendor Advisory
- http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html ExploitThird Party AdvisoryVDB Entry
- https://cwe.mitre.org/data/definitions/502.html Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10189 US Government Resource
CPE-Treffer (NVD) (1)
cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*< 10.0.479