CVE-2022-48362 Path traversal in n/a

What is CVE-2022-48362?

CVE-2022-48362 is a high-severity path traversal vulnerability in n/a, published on 25 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, authenticated attacker could upload arbitrary code that would be executed when Desktop Central is restarted. (The attacker could authenticate by exploiting CVE-2021-44515.)

Weakness: CWE-22

Which versions are affected by CVE-2022-48362?

It affects 1 product.

Products include Zohocorp Manageengine Desktop Central.

How do I fix CVE-2022-48362?

No fix has been published for CVE-2022-48362 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-48362 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-48362 exists.

Other vulnerabilities in n/a

• CVE-2021-44515 Zoho Desktop Central Authentication Bypass Exploited Critical 9.8
• CVE-2020-10189 Zoho ManageEngine Desktop Central File Upload Exploited Critical 9.8
• CVE-2017-7213 Auth bypass in n/a Critical 10.0
• CVE-2014-9371 Code injection in n/a Critical 10.0
• CVE-2020-15588 Integer overflow in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4g2p-qp5f-9gmj.