CVE-2020-8540: 
Zoho ManageEngine Desktop Central Server vulnerability analysis and mitigation

An XML external entity (XXE) vulnerability was discovered in Zoho ManageEngine Desktop Central, identified as CVE-2020-8540. The vulnerability affected versions before the March 7, 2020 update, allowing remote unauthenticated users to perform unauthorized operations. The vulnerability was reported by security researcher kalimer0x00 (ManageEngine Doc, NVD).

The vulnerability exists in the agent servlet component where the server parses XML input from the agent periodically to process the data. The issue occurs when there is a reference to an external entity in the XML file that could be malicious, potentially leading to unintended operations and server crashes (ManageEngine Doc).

The vulnerability could allow remote unauthenticated users to read sensitive data and potentially cause server crashes through malicious XML processing (NVD).

The vulnerability was patched in build 10.0.479 and above, released on March 7, 2020. Users are advised to update to the latest build by logging into their Desktop Central console and downloading the applicable update from the top-right corner build number (ManageEngine Doc).