Description
Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, authenticated attacker could upload arbitrary code that would be executed when Desktop Central is restarted. (The attacker could authenticate by exploiting CVE-2021-44515.)
Advisories 1
- WID-SEC-2023-0480 Zoho ManageEngine Endpoint Central: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Feb 26, 2023