CVE-2018-13412

An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version.

Score

CVSS 3.0 7.8 High

Status

Modified - cve@mitre.org

Published

2018-09-12

Last modified

2024-08-05

Weaknesses

CWE-732

Affected products

• Manageengine Desktop Central (Zohocorp)

References

• http://www.securityfocus.com/bid/105348
• https://github.com/AJ-SA/Zoho-ManageEngine/blob/master/README.md
• https://www.manageengine.com/products/desktop-central/elevation-of-system-privilege.html