The vulnerability of the AgentLogUploadServlet component of the software for managing workstations via the web interface ManageEngine Desktop Central, as well as the remote monitoring and management tools for desktop PCs, servers, laptops, and mobile devices provided by ManageEngine Endpoint Central MSP (previously ManageEngine Desktop Central MSP), allows a malicious individual to circumvent security restrictions and execute arbitrary code.

🗓️ 07 Mar 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

AgentLogUploadServlet flaw in ManageEngine Desktop Central and Endpoint Central enables restriction bypass and arbitrary code execution via computerName.

Reporter	Title	Published	Views	Family All 39
ATTACKERKB	CVE-2021-44515	20 Aug 202500:00	–	attackerkb
BDU FSTEC	The vulnerability of the software for the Zoho ManageEngine SupportCenter Plus service lies in its authentication procedures. This vulnerability allows a perpetrator to bypass the authentication process and gain unauthorized access to the device.	17 Dec 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the ManageEngine Desktop Central software for managing workstations via a web interface stems from deficiencies in the authentication process. This allows a perpetrator to bypass the authentication procedures and execute arbitrary code.	20 Dec 202100:00	–	bdu_fstec
Circl	CVE-2021-44515	4 Dec 202106:14	–	circl
Circl	CVE-2022-48362	26 Feb 202314:27	–	circl
CISA KEV Catalog	Zoho Desktop Central Authentication Bypass Vulnerability	10 Dec 202100:00	–	cisa_kev
CISA	CISA Adds Thirteen Known Exploited Vulnerabilities to Catalog	10 Dec 202100:00	–	cisa
CISA	Zoho Releases Security Advisory for ManageEngine Desktop Central and Desktop Central MSP	6 Dec 202100:00	–	cisa
CISA	CISA Adds 13 Known Exploited Vulnerabilities to Catalog	10 Dec 202100:00	–	cisa
CNNVD	ZOHO ManageEngine Desktop Central MSP 授权问题漏洞	6 Dec 202100:00	–	cnnvd

Vulners

Node

zoho manageengine_desktop_centralRange<10.1.2137.2

OR

zoho manageengine_endpoint_central_mspRange<10.1.2137.2

Source	Link
srcincite	www.srcincite.io/blog/2022/01/20/zohowned-a-critical-authentication-bypass-on-zoho-manageengine-desktop-central.html
attackerkb	www.attackerkb.com/topics/rJw4DFI2RQ/cve-2021-44515/rapid7-analysis
pitstop	www.pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-desktop-central-msp
ic3	www.ic3.gov/Media/News/2021/211220.pdf
web	www.web.nvd.nist.gov/view/vuln/detail

13 Sep 2024 00:00Current

8.4High risk

Vulners AI Score8.4

CVSS 29

CVSS 39.6

EPSS0.94347

AgentLogUploadServlet ManageEngine Desktop Central Endpoint Central Restriction bypass Arbitrary code execution