module
ManageEngine Desktop Central Java Deserialization
| Disclosed |
|---|
| Mar 5, 2020 |
Disclosed
Mar 5, 2020
Description
This module exploits a Java deserialization vulnerability in the
getChartImage() method from the FileStorage class within ManageEngine
Desktop Central versions
Quoting the vendor's advisory on fixed versions:
"The short-term fix for the arbitrary file upload vulnerability was
released in build 10.0.474 on January 20, 2020. In continuation of
that, the complete fix for the remote code execution vulnerability is
now available in build 10.0.479."
getChartImage() method from the FileStorage class within ManageEngine
Desktop Central versions
Quoting the vendor's advisory on fixed versions:
"The short-term fix for the arbitrary file upload vulnerability was
released in build 10.0.474 on January 20, 2020. In continuation of
that, the complete fix for the remote code execution vulnerability is
now available in build 10.0.479."
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.