CVE-2013-7390 File upload in n/a

What is CVE-2013-7390?

CVE-2013-7390 is a critical vulnerability in n/a, published on 27 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension, then accessing it via a direct request to the file in the webroot.

Weakness: CWE-434

Which versions are affected by CVE-2013-7390?

It affects 1 product.

Products include Zohocorp Manageengine Desktop Central.

How do I fix CVE-2013-7390?

No fix has been published for CVE-2013-7390 yet. Limit exposure of the affected software until one is available.

Is CVE-2013-7390 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-7390 exists.

Public exploit code: 1 Metasploit module and 3 Exploit-DB entries.

Other vulnerabilities in n/a

• CVE-2021-44515 Zoho Desktop Central Authentication Bypass Exploited Critical 9.8
• CVE-2020-10189 Zoho ManageEngine Desktop Central File Upload Exploited Critical 9.8
• CVE-2017-7213 Auth bypass in n/a Critical 10.0
• CVE-2014-9371 Code injection in n/a Critical 10.0
• CVE-2020-15588 Integer overflow in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2jw2-8v9p-h7mp.