Описание
Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the webroot.
Ссылки
- ExploitMailing ListThird Party Advisory
- ExploitThird Party Advisory
- ExploitMailing ListThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 7.0.0 (включая) до 8.0.0 (включая)
cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*
EPSS
Процентиль: 98%
0.6678
Средний
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-434
Связанные уязвимости
github
почти 4 года назад
Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the webroot.
EPSS
Процентиль: 98%
0.6678
Средний
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-434