VulnerabilityModified

CVE-2022-23779

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone.

MEDIUM 5.3EPSS 15.1%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 15.1%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 15.14% probability · 97th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: zohocorp/manageengine desktop central
Source: cve@mitre.org

References

https://www.manageengine.com/products/desktop-central/cve-2022-23779.htmlVendor Advisory
https://www.manageengine.com/products/desktop-central/cve-2022-23779.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.