Main Vulnerability Database Vulnerabilities #VU48148

Permissions, Privileges, and Access Controls in Zoho ManageEngine Desktop Central - #VU48148

Published: November 4, 2020

Vulnerability identifier: #VU48148

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to bundled nginx, which leads to security restrictions bypass and privilege escalation.

Zoho ManageEngine Desktop Central

Install updates from vendor's website.

Zoho ManageEngine Desktop Central - update to 10.0.604