module
ManageEngine Desktop Central Java Deserialization
| Disclosed |
|---|
| Mar 5, 2020 |
Disclosed
Mar 5, 2020
Description
This module exploits a Java deserialization vulnerability in the
getChartImage() method from the FileStorage class within ManageEngine
Desktop Central versions
Quoting the vendor's advisory on fixed versions:
"The short-term fix for the arbitrary file upload vulnerability was
released in build 10.0.474 on January 20, 2020. In continuation of
that, the complete fix for the remote code execution vulnerability is
now available in build 10.0.479."
getChartImage() method from the FileStorage class within ManageEngine
Desktop Central versions
Quoting the vendor's advisory on fixed versions:
"The short-term fix for the arbitrary file upload vulnerability was
released in build 10.0.474 on January 20, 2020. In continuation of
that, the complete fix for the remote code execution vulnerability is
now available in build 10.0.479."
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.