CVE-2020-10189

Zoho ManageEngine Desktop Central File Upload Vulnerability

Manageengine Desktop Central

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.

6. Mär 2020

Ausgewertete Quellen

• Hersteller
  https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html
• Hinweis
  http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html
• Hinweis
  https://cwe.mitre.org/data/definitions/502.html
• Hinweis
  https://srcincite.io/advisories/src-2020-0011/
• Hinweis
  https://srcincite.io/pocs/src-2020-0011.py.txt
• Hinweis
  https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10189
• CISA
  Zoho ManageEngine Desktop Central File Upload Vulnerability
• NVD
  CVE-2020-10189