Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-5341: Zoho ManageEngine Desktop Central lets attackers replace scripts

CVE-2018-5341 · published 8 years ago

Summary

The Desktop Central product does not properly verify the type of files uploaded as scripts. This allows a user with upload rights to place malicious code that could run on the server. Apply the vendor’s update and limit script‑upload permissions to trusted administrators.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
zohocorp	manageengine_desktop_central	10.0.124 10.0.184 `cpe:2.3:a:zohocorp:manageengine_desktop_central:10.0.124:::::::*`

Original advisory text

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: a missing server-side check on the file type/extension when uploading and modifying scripts.

References

https://www.manageengine.com/products/desktop-central/elevation-of-privilege-vul... Third Party Advisory
https://www.nccgroup.trust/uk/our-research/technical-advisory-multiple-vulnerabi... Exploit Technical Description Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

8% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published18 Apr 2018

Updated15 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-5341 · NVD

Track software like this

Free during beta