CVE-2018-13412: High severity manageengine desktop central vulnerability
Published Sep 12, 2018
·Updated
An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version.
Affected Software
1 affected component
ZohoCorp Manageengine Desktop Central<10.0.282
Event History
Sep 12, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this issue in Zoho ManageEngine Desktop Central?
The vulnerability ID of this issue in Zoho ManageEngine Desktop Central is CVE-2018-13412.
2
What is the severity rating of CVE-2018-13412?
The severity rating of CVE-2018-13412 is high, with a value of 7.8.
3
What software versions are affected by CVE-2018-13412?
Versions up to and excluding 10.0.282 of Zoho ManageEngine Desktop Central are affected by CVE-2018-13412.
4
How can CVE-2018-13412 be exploited to escalate privileges?
CVE-2018-13412 can be exploited by abusing a clickable company logo in a window running as SYSTEM.
5
Is CVE-2018-13412 fixed in the cloud version of Zoho ManageEngine Desktop Central?
Yes, the issue is fixed in 10.0.470 agent version of Zoho ManageEngine Desktop Central in the cloud.