CVE-2019-16962: 
Zoho ManageEngine Desktop Central Server vulnerability analysis and mitigation

CVE-2019-16962 is an HTML Injection vulnerability discovered in ManageEngine Endpoint Central (formerly DesktopCentral), a Unified Endpoint Management (UEM) solution. The vulnerability was identified by Abhinav Khanna from eSec Forte Technologies and allows authenticated users to inject arbitrary HTML code in the Report Name parameter of custom reports (ManageEngine, ESec Forte).

The vulnerability exists in the custom reports functionality where the application fails to properly sanitize user input in the Report Name parameter. This allows authenticated users to inject arbitrary HTML code that gets rendered when viewing custom reports. The issue was fixed in Endpoint Central build 10.0.486 (ManageEngine).

When exploited, this vulnerability could allow attackers to inject malicious HTML code that gets executed in users' browsers when viewing custom reports. This could potentially lead to phishing attacks by injecting fake login forms or other malicious content that appears legitimate since it's served from a trusted domain (ESec Forte).

The vulnerability requires authentication to exploit, as an attacker needs access to the custom reports functionality. The attack can be executed by intercepting and modifying the 'requestname' parameter when creating or modifying custom reports (ESec Forte).

Users should upgrade to Endpoint Central build 10.0.486 or later which contains the fix for this vulnerability. The update can be applied by logging into the Endpoint Central console, clicking on the current build number on the top right corner, and downloading and applying the latest PPM update (ManageEngine).