CVE-2020-10859: 
Zoho ManageEngine Desktop Central Server vulnerability analysis and mitigation

Zoho ManageEngine Desktop Central before version 10.0.484 contains an authenticated arbitrary file write vulnerability (CVE-2020-10859). The vulnerability exists in the ZIP decompressing functionality where authenticated users with permissions to add apps to the App Repository could exploit directory traversal in a crafted AppDependency API request during ZIP archive extraction (Vendor Advisory).

The vulnerability stems from improper validation in the Windows app dependency file upload functionality, specifically in the ZIP decompressing portion. The flaw can be exploited by crafting a ZIP file with malicious path, allowing authenticated users with specific permissions to upload arbitrary files without proper validation. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (NVD).

If successfully exploited, this vulnerability allows authenticated attackers to perform arbitrary file writes on the system during the ZIP archive extraction process. This could potentially lead to unauthorized file manipulation and system compromise (Vendor Advisory).

The vulnerability requires authentication and specific permissions (ability to add apps to the App Repository) to exploit. The attacker would need to craft a malicious ZIP file with specific path traversal elements to trigger the vulnerability (Vendor Advisory).

The vulnerability has been fixed in ManageEngine Desktop Central build version 10.0.484. Users should upgrade to this version or later to address the vulnerability. The issue is not applicable to cloud editions of Desktop Central, Patch Manager Plus, and Remote Access Plus (Vendor Advisory).