A vulnerability, which was classified as critical, has been found in Zoho ManageEngine Desktop Central 10.0.255 (Endpoint Management Software). Affected by this issue is some unknown processing of the file /agenttrayicon of the component Access Control. The manipulation of the argument computerName with the input value ../ leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is integrity, and availability. CVE summarizes:

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI.

The bug was discovered 06/29/2018. The weakness was presented 06/29/2018 as not defined mailinglist post (Full-Disclosure). The advisory is available at seclists.org. This vulnerability is handled as CVE-2018-12999 since 06/29/2018. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 371044 (Zoho ManageEngine Desktop Central Incorrect Access Control Vulnerability).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Type

• Endpoint Management Software

Vendor

• Zoho ManageEngine

Name

• Desktop Central

Version

• 10.0.255

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion