CVE-2022-48362
High
Description
Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, authenticated attacker could upload arbitrary code that would be executed when Desktop Central is restarted. (The attacker could authenticate by exploiting CVE-2021-44515.)
SeverityHigh
CVSS8.8
Exploit probability—
ProductZohocorp Manageengine Desktop Central
PublishedFeb 25, 2023
First seenFeb 25, 2023
Weakness typeCWE-22Path traversal
How to fix
Update
- zohocorp manageengine_desktop_central10.1.2137.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zohocorp manageengine_desktop_central | v < 10.1.2137.2 | 10.1.2137.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.