CVE-2022-48362

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, authenticated attacker could upload arbitrary code that would be executed when Desktop Central is restarted. (The attacker could authenticate by exploiting CVE-2021-44515.)

*Credits: N/A

CVSS Scores

NISTv3.1 8.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-02-25 CVE Reserved
2023-02-25 CVE Published
2024-08-03 CVE Updated
2024-08-03 First Exploit
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (2)

URL	Tag	Source
https://www.manageengine.com/products/desktop-central/cve-2022-48362.html

URL	Date	SRC
https://srcincite.io/blog/2022/01/20/zohowned-a-critical-authentication-bypass-on-zoho-manageengine-desktop-central.html	2024-08-03

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Zohocorp Search vendor "Zohocorp"		Manageengine Desktop Central Search vendor "Zohocorp" for product "Manageengine Desktop Central"				< 10.1.2137.2 Search vendor "Zohocorp" for product "Manageengine Desktop Central" and version " < 10.1.2137.2"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Desktop Central Search vendor "Zohocorp" for product "Manageengine Desktop Central"				< 10.1.2137.2 Search vendor "Zohocorp" for product "Manageengine Desktop Central" and version " < 10.1.2137.2"		managed_service_providers		Affected