PT-2018-11808 · Zoho · Zoho Manageengine Desktop Central

Abdullah Aljaber · Publicado 2018-09-12 · Atualizado 2021-04-21 · CVE-2018-13412

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions prior to 10.0.282 Zoho ManageEngine Desktop Central agent versions prior to 10.0.470

Description An issue in the Self Service Portal of Zoho ManageEngine Desktop Central allows a clickable company logo in a window running as SYSTEM to be abused for privilege escalation.

Recommendations For versions prior to 10.0.282, update to version 10.0.282 or later to resolve the issue. For cloud agent versions prior to 10.0.470, update to agent version 10.0.470 or later to resolve the issue.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-13412

Produtos afetados

Zoho Manageengine Desktop Central

Referências · 5

• https://github.com/AJ-SA/Zoho-ManageEngine/blob/master/README.md · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-13412 · Nota de Segurança
• http://securityfocus.com/bid/105348 · Nota
• https://manageengine.com/products/desktop-central/elevation-of-system-privilege.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-13412 · Aviso do Fabricante