CVE-2020-10859: Path Traversal
Published May 5, 2020
·Updated
Zoho ManageEngine Desktop Central before 10.0.484 allows authenticated arbitrary file writes during ZIP archive extraction via Directory Traversal in a crafted AppDependency API request.
Affected Software
1 affected component
ZohoCorp Manageengine Desktop Central<10.0.484
Event History
May 5, 2020
CVE Published
via MITRE·08:16 PM
Data Sourced
via MITRE·08:16 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2020-10859.
2
What is the severity of CVE-2020-10859?
CVE-2020-10859 has a severity rating of medium with a value of 6.5.
3
What is the affected software for CVE-2020-10859?
The affected software for CVE-2020-10859 is Zoho ManageEngine Desktop Central before version 10.0.484.
4
How does CVE-2020-10859 work?
CVE-2020-10859 allows authenticated users to perform arbitrary file writes during ZIP archive extraction by exploiting a directory traversal vulnerability in a crafted AppDependency API request.
5
Is there a fix for CVE-2020-10859?
Yes, the fix for CVE-2020-10859 is to upgrade to Zoho ManageEngine Desktop Central version 10.0.484 or later.