PT-2018-11808 · Zoho · Zoho Manageengine Desktop Central

Abdullah Aljaber · Published 2018-09-12 · Updated 2021-04-21 · CVE-2018-13412

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions prior to 10.0.282 Zoho ManageEngine Desktop Central agent versions prior to 10.0.470

Description An issue in the Self Service Portal of Zoho ManageEngine Desktop Central allows a clickable company logo in a window running as SYSTEM to be abused for privilege escalation.

Recommendations For versions prior to 10.0.282, update to version 10.0.282 or later to resolve the issue. For cloud agent versions prior to 10.0.470, update to agent version 10.0.470 or later to resolve the issue.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-13412

Affected Products

Zoho Manageengine Desktop Central

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-13412 · Security Note
• https://manageengine.com/products/desktop-central/elevation-of-system-privilege.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-13412 · Vendor Advisory
• https://github.com/AJ-SA/Zoho-ManageEngine/blob/master/README.md · Note
• http://securityfocus.com/bid/105348 · Note