high8.8
CVE-2022-48362
Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet.
Impact
Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, authenticated attacker could upload arbitrary code that would be executed when Desktop Central is restarted. (The attacker could authenticate by exploiting CVE-2021-44515.)
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Manageengine Desktop Central | before 10.1.2137.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://srcincite.io/blog/2022/01/20/zohowned-a-critical-authentication-bypass-on-zoho-manageengine-desktop-central.html
- https://www.manageengine.com/products/desktop-central/cve-2022-48362.html
- https://srcincite.io/blog/2022/01/20/zohowned-a-critical-authentication-bypass-on-zoho-manageengine-desktop-central.html
- https://www.manageengine.com/products/desktop-central/cve-2022-48362.html