Zoho · ManageEngine
CVE-2020-10189
Zoho ManageEngine Desktop Central File Upload Vulnerability
Exploited in attacks
Critical 9.8 Attack chance: 99.9%
What it is
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
CISA: Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- March 6, 2020
- Severity
- Critical 9.8 CVSS 3.0
- Chance of attacks in the next 30 days (EPSS)
- 99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-502
- More details
- NVD · CVE.org · CISA
All references (6)
- https://srcincite.io/advisories/src-2020-0011/
- https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/
- https://srcincite.io/pocs/src-2020-0011.py.txt
- https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html
- http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html
- https://cwe.mitre.org/data/definitions/502.html
More exploited flaws from Zoho
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 7, 2023 | ADSelfService Plus Remote Code Execution | ManageEngine | Medium 6.8 | 71% |
| Jan 23, 2023 | Multiple Products Remote Code Execution | ManageEngine | Critical 9.8 | 99.8% |
| Sep 22, 2022 | Multiple Products Remote Code Execution | ManageEngine | Critical 9.8 | 99.9% |
| Nov 3, 2021 | ServiceDesk Plus (SDP) File Upload | ManageEngine | High 7.5 | 63% |
| Nov 3, 2021 | ADSelfService Plus Authentication Bypass | ManageEngine | Critical 9.8 | 99% |
| Dec 10, 2021 | Authentication Bypass | Desktop Central | Critical 9.8 | 99.9% |
| Dec 1, 2021 | ManageEngine ServiceDesk Authentication Bypass | ManageEngine ServiceDesk Plus (SDP) | Critical 9.8 | 99.8% |
| Dec 1, 2021 | ManageEngine ServiceDesk Plus Remote Code Execution | ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Critical 9.8 | 93% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.