Description

Zoho ManageEngine Desktop Central before 10.0.474 have a java deserialization vulnerability. An attacker could exploit this vulnerability using specially-crafted serialized data to execute arbitrary code on the system.

Remediation

Upgrade to the latest version of ManageEngine Desktop Central

References

ManageEngine Desktop Central FileStorage getChartImage Deserialization of Untrusted Data Remote Code Execution Vulnerability

Related Vulnerabilities

Sitecore XP TemplateParser RCE (CVE-2023-35813)

Appwrite favicon SSRF (CVE-2023-27159)

VMware vCenter Server Unauthorized Remote Code Execution

PHP preg_replace used on user input

WordPress Plugin VaultPress Remote Code Execution (1.9.0)

Severity

High

Classification

CVE-2020-10189 CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Acumonitor Code Execution