PT-2024-20019 · Zoho · Manageengine Desktop Central

Published 2024-03-11 · Updated 2024-03-20 · CVE-2024-2370

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central version 9, build 90055

Description A critical flaw in ManageEngine Desktop Central poses a major security risk due to an unrestricted file upload vulnerability. This issue could allow a remote attacker to upload a malicious file to the system without any credentials provided.

Recommendations For ManageEngine Desktop Central version 9, build 90055, consider disabling the file upload feature until a patch is available to prevent exploitation. Restrict access to the system to minimize the risk of malicious file uploads. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2024-2370

Affected Products

Manageengine Desktop Central

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-2370 · Security Note
• https://t.me/pentestingnews/44590 · Telegram Post
• https://twitter.com/catnap707/status/1767374758012928405 · Twitter Post
• https://twitter.com/CVEnew/status/1767178422152015958 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1767366685349363718 · Twitter Post
• https://twitter.com/vuldb/status/1767202203771789453 · Twitter Post
• https://twitter.com/moton/status/1767561636599263546 · Twitter Post
• https://twitter.com/cracbot/status/1767602863667118447 · Twitter Post
• https://t.me/cvenotify/73551 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1767196182067962176 · Twitter Post
• https://t.me/cvenotify/73474 · Telegram Post