9.8Crítica
KEV
CVE-2020-10189Zoho ManageEngine Desktop Central File Upload Vulnerability
Explotación conocida — Zoho ManageEngine Desktop Central File Upload Vulnerability
CISA confirmó el 03.11.2021 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 03.05.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-10189
Descripción
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
Debilidad (CWE):
CWE-502
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| zohocorp | manageengine desktop central | < 10.0.479 |
Referencias y parches
- https://srcincite.io/advisories/src-2020-0011/ ExploitThird Party Advisory
- https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/ Third Party Advisory
- https://srcincite.io/pocs/src-2020-0011.py.txt ExploitThird Party Advisory
- https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html Vendor Advisory
- http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html ExploitThird Party AdvisoryVDB Entry
- https://cwe.mitre.org/data/definitions/502.html Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10189 US Government Resource
Coincidencias CPE (NVD) (1)
cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*< 10.0.479