PT-2022-12223 · Zoho · Zoho Manageengine Desktop Central

Published 2022-01-18 · Updated 2022-07-12 · CVE-2021-44757

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central versions prior to 10.1.2137.9 Zoho ManageEngine Desktop Central MSP versions prior to 10.1.2137.9

Description The issue allows attackers to bypass authentication, enabling them to read sensitive information or upload an arbitrary ZIP archive to the server. This can be exploited by a remote adversary to perform unauthorized actions in affected servers.

Recommendations For Zoho ManageEngine Desktop Central versions prior to 10.1.2137.9, update to version 10.1.2137.9 or later. For Zoho ManageEngine Desktop Central MSP versions prior to 10.1.2137.9, update to version 10.1.2137.9 or later.

Fix

Related Identifiers

CVE-2021-44757

Affected Products

Zoho Manageengine Desktop Central

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2021-44757 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44757 · Vendor Advisory
• https://pitstop.manageengine.com/portal/en/community/topic/a-critical-security-patch-released-in-desktop-central-and-desktop-central-msp-for-cve-2021-44757-17-1-2022 · Vendor Advisory
• https://t.me/pentestingnews/17330 · Telegram Post
• https://t.me/cvenotify/25567 · Telegram Post
• https://t.me/my_cyde/253 · Telegram Post
• https://t.me/thehackernews/1799 · Telegram Post
• https://t.me/cibsecurity/35695 · Telegram Post
• https://t.me/true_secator/2529 · Telegram Post
• https://t.me/cibsecurity/35682 · Telegram Post