PT-2017-3507 · Manageengine · Manageengine Desktop Central

Published 2017-04-12 · Updated 2017-05-23 · CVE-2017-7213

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to build 100082

Description The issue is related to insufficient input validation in the web interface of ManageEngine Desktop Central, allowing remote attackers to gain control over all connected active desktops.

Recommendations For ManageEngine Desktop Central versions prior to build 100082, update to build 100082 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface until the update is applied.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2018-00354

CVE-2017-7213

Affected Products

Manageengine Desktop Central

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-7213 · Security Note
• https://manageengine.com/products/desktop-central/cve-2017-7213-remote-control-privilege-violation.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00354 · Security Note