PT-2021-18002 · Manageengine · Manageengine Desktop Central

Published 2021-09-21 · Updated 2021-11-28 · CVE-2021-28960

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ManageEngine Desktop Central versions prior to 10.0.683

Description: The issue arises from improper handling of an input command in on-demand operations, allowing unauthenticated command injection. This can lead to unauthenticated remote code execution during communication with the Notification Server.

Recommendations: For versions prior to 10.0.683, update to build 10.0.683 or later to resolve the issue. As a temporary workaround, consider restricting access to on-demand operations until a patch is applied.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2021-28960

Affected Products

Manageengine Desktop Central

References · 5

• https://manageengine.com/products/desktop-central/unauthenticated-command-injection-vulnerability.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-28960 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28960 · Security Note
• https://manageengine.com · Vendor Advisory
• https://t.me/cibsecurity/29181 · Telegram Post