CVE-2018-12999

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-06-29 · updated 2026-06-17
Weakness: CWE-20

Description

Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server without login by sending a specially crafted request to the server with a computerName=../ substring to the /agenttrayicon URI.

Affected products

ManageEngine Desktop Central: 10.0.255

References

http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html
http://seclists.org/fulldisclosure/2018/Jul/74
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-035
https://github.com/unh3x/just4cve/issues/9
http://packetstormsecurity.com/files/148635/Zoho-ManageEngine-13-13790-build-XSS-File-Read-File-Deletion.html
http://seclists.org/fulldisclosure/2018/Jul/74
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201807-035
https://github.com/unh3x/just4cve/issues/9

Get alerted when CVE-2018-12999 or the next vulnerability affects your stack