CVE-2018-12999

Published: 2018-06-29T12:29Z

Last Modified: 2024-11-21T03:46Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt