← CVE Radar
CVE-2020-10189Zoho ManageEngine Desktop Central File Upload Vulnerability
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
9.8 CRITICALEPSS 99.94%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 9.8 | CRITICAL | 3.0mitre (CNA) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 9.8 | CRITICAL | 3.0mitre (CNA) | CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N |
| 10.0 | HIGH | 2.0NVD | AV:N/AC:L/Au:N/C:C/I:C/A:C |
CISA required action
⚡ Known exploited · remediation due May 3, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2020-10189
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- Mar 6, 2020
- Last modified
- 2026-06-17 02:47 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
zohocorpmanageengine desktop central1 version range
- before 10.0.479
References
- packetstormsecurity.com http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html
- cwe.mitre.org https://cwe.mitre.org/data/definitions/502.html
- srcincite.io https://srcincite.io/advisories/src-2020-0011/
- srcincite.io https://srcincite.io/pocs/src-2020-0011.py.txt
- manageengine.com https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html
- zdnet.com https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10189