CVE-2022-23779

Description

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

Vulnmachines/Zoho_CVE-2022-23779 ★ 5 · Aug 24, 2022

Internal Hostname Disclosure Vulnerability
fbusr/CVE-2022-23779 ★ 1 · Mar 5, 2022

CVE-2022-23779: Internal Hostname Disclosure Vulnerability
Rishi-kaul/CVE-2022-23779 ★ 0 · Jan 10, 2026

CVE-2022-23779 is a security vulnerability in Zoho ManageEngine Desktop Central ,Testing for CVE-2022-23779 using curl

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Zoho ManageEngine - Internal Hostname Disclosure http/cves/2022/CVE-2022-23779.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References

https://www.manageengine.com/products/desktop-central/cve-2022-23779.html