by Kastro
Paper/Archive/CVE-2020-10189

CVE-2020-10189

Zoho ManageEngine — Zoho ManageEngine Desktop Central File Upload Vulnerability

KEV · due 3 MayEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

mitre (CNA)9.8CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsrcincite.io/advisories/src-2020-0011refzdnet.com/article/zoho-zero-day-published-on-twitterrefsrcincite.io/pocs/src-2020-0011.py.txtrefmanageengine.com/products/desktop-central/remote-code-execution-vulnerability.htmlrefpacketstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.htmlrefcwe.mitre.org/data/definitions/502.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10189kevcisa.gov/known-exploited-vulnerabilities-catalog