CVE-2022-48362

Katalog CVE

CVSS 8.8 · High EPSS 8,7%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada zohocorp manageengine desktop central. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, authenticated attacker could upload arbitrary code that would be executed when Desktop Central is restarted. (The attacker could authenticate by exploiting CVE-2021-44515.)

Rincian

Terbit di NVD

25 Februari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

8,7% peluang dieksploitasi; lebih tinggi dari 95,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://srcincite.io/blog/2022/01/20/zohowned-a-critical-authentication-bypass-on-zoho-manageengine-desktop-ce... exploit · advisory vendor
• https://www.manageengine.com/products/desktop-central/cve-2022-48362.html