Vulnerability Details : CVE-2018-5341
An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts.
Vulnerability category: Input validation
Products affected by CVE-2018-5341
- cpe:2.3:a:zohocorp:manageengine_desktop_central:10.0.124:*:*:*:*:*:*:*
- cpe:2.3:a:zohocorp:manageengine_desktop_central:10.0.184:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-5341
1.63%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 86 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-5341
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2018-5341
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-5341
-
https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vulnerability.html
Security Updates on Vulnerabilities - Elevation of PrevilegeThird Party Advisory
-
https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabilities-in-manageengine-desktop-central/
Technical Advisory: Multiple Vulnerabilities in ManageEngine Desktop CentralExploit;Third Party Advisory;Technical Description
Jump to