CVE-2020-10189 Zoho ManageEngine Desktop Central File Upload

What is CVE-2020-10189?

CVE-2020-10189 is a critical unsafe deserialization vulnerability in n/a, published on 6 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.

Weakness: CWE-502

Which versions are affected by CVE-2020-10189?

It affects 1 product.

Products include Zohocorp Manageengine Desktop Central.

How do I fix CVE-2020-10189?

No fix has been published for CVE-2020-10189 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2020-10189 being exploited?

Yes. Attackers have exploited CVE-2020-10189 in the wild since at least 3 Nov 2021.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2021-44515 Zoho Desktop Central Authentication Bypass Exploited Critical 9.8
• CVE-2017-7213 Auth bypass in n/a Critical 10.0
• CVE-2014-9371 Code injection in n/a Critical 10.0
• CVE-2020-15588 Integer overflow in n/a Critical 9.8
• CVE-2020-8540 XML external entity in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cx3q-6fpx-362x.