CVE-2017-11346

Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.exploit-db.com/exploits/42358/
https://www.manageengine.com/products/desktop-central/remote-code-execution.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-07-17 13:18

Updated : 2024-02-04 19:29

NVD link : CVE-2017-11346

Mitre link : CVE-2017-11346

CVE.ORG link : CVE-2017-11346

JSON object : View

Products Affected

zohocorp

manageengine_desktop_central

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2017-11346", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-07-17T13:18:21.017", "references": [{"url": "https://www.exploit-db.com/exploits/42358/", "source": "cve@mitre.org"}, {"url": "https://www.manageengine.com/products/desktop-central/remote-code-execution.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos."}, {"lang": "es", "value": "Desktop Central antes del build 100092 de Zoho ManageEngine, permite a los atacantes remotos ejecutar c\u00f3digo arbitrario por medio de vectores que involucran la carga de videos de soporte al usuario."}], "lastModified": "2017-08-12T01:29:03.267", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61F8D5C2-47A1-4D4C-88A7-A64C0D9250C6", "versionEndIncluding": "10.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}