CVE-2020-10189

CriticalKnown Exploited

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in…

mitre·CWE-502·Published 2020-03-06

CVSS

9.8

EPSS

1.00

KEV

Yes

Exploits

cve.orgen

239 chars

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.

NVDen

239 chars

NVDes

271 chars

Zoho ManageEngine Desktop Central anterior a la versión 10.0.474 permite la ejecución remota de código debido a la deserialización de datos no seguros en getChartImage en la clase FileStorage. Esto está relacionado con los servlets CewolfServlet y MDMLogUploaderServlet.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	10.0	10.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C
3.0	Primary	cve.org	9.8	—	—	CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N