CVE-2024-10203 - Vulnerability Details

Vendors	Products
Zohocorp	Manageengine Endpoint Central

Link	Providers
https://www.manageengine.com/products/desktop-central/cve-2024-10203.html

Type	Values Removed	Values Added
First Time appeared		Zohocorp Zohocorp manageengine Endpoint Central
CPEs		cpe:2.3:a:zohocorp:manageengine_endpoint_central::::::::
Vendors & Products		Zohocorp Zohocorp manageengine Endpoint Central
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.
Title		Agent Arbitrary File Deletion
Weaknesses		CWE-269
References		https://www.manageengine.com/products/desktop-central/cve-2024-10203.html
Metrics		cvssV3_1 `{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10203", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "state": "PUBLISHED", "assignerShortName": "ManageEngine", "dateReserved": "2024-10-21T04:28:34.057Z", "datePublished": "2024-11-07T09:20:07.450Z", "dateUpdated": "2024-11-07T14:27:15.677Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "EndPoint Central", "vendor": "ManageEngine", "versions": [{"lessThan": "11.3.2416.22", "status": "affected", "version": "0", "versionType": "11.3.2416.21"}, {"lessThan": "11.3.2428.10", "status": "affected", "version": "0", "versionType": "11.3.2416.22"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Brenden Meeder"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.<br>"}], "value": "Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "ManageEngine", "dateUpdated": "2024-11-07T09:20:07.450Z"}, "references": [{"url": "https://www.manageengine.com/products/desktop-central/cve-2024-10203.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Agent Arbitrary File Deletion", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "zohocorp", "product": "manageengine_endpoint_central", "cpes": ["cpe:2.3:a:zohocorp:manageengine_endpoint_central:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThan": "11.3.2416.22", "versionType": "custom"}, {"version": "0", "status": "affected", "lessThan": "11.3.2428.10", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-07T14:14:19.663318Z", "id": "CVE-2024-10203", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-07T14:27:15.677Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-10203 (string)

assignerOrgId : 0fc0942c-577d-436f-ae8e-945763c79b02 (string)

state : PUBLISHED (string)

assignerShortName : ManageEngine (string)

dateReserved : 2024-10-21T04:28:34.057Z (string)

datePublished : 2024-11-07T09:20:07.450Z (string)

dateUpdated : 2024-11-07T14:27:15.677Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : EndPoint Central (string)

vendor : ManageEngine (string)

versions : [ »

0 : { »

lessThan : 11.3.2416.22 (string)

status : affected (string)

version : 0 (string)

versionType : 11.3.2416.21 (string)

}

1 : { »

lessThan : 11.3.2428.10 (string)

status : affected (string)

version : 0 (string)

versionType : 11.3.2416.22 (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Brenden Meeder (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.<br> (string)

}

]

value : Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-269 (string)

description : CWE-269 Improper Privilege Management (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 0fc0942c-577d-436f-ae8e-945763c79b02 (string)

shortName : ManageEngine (string)

dateUpdated : 2024-11-07T09:20:07.450Z (string)

}

references : [ »

0 : { »

url : https://www.manageengine.com/products/desktop-central/cve-2024-10203.html (string)

}

]

source : { »

discovery : EXTERNAL (string)

}

title : Agent Arbitrary File Deletion (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : zohocorp (string)

product : manageengine_endpoint_central (string)

cpes : [ »

0 : cpe:2.3:a:zohocorp:manageengine_endpoint_central:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 0 (string)

status : affected (string)

lessThan : 11.3.2416.22 (string)

versionType : custom (string)

}

1 : { »

version : 0 (string)

status : affected (string)

lessThan : 11.3.2428.10 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-11-07T14:14:19.663318Z (string)

id : CVE-2024-10203 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-07T14:27:15.677Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10203", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-07T14:14:19.663318Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:zohocorp:manageengine_endpoint_central:*:*:*:*:*:*:*:*"], "vendor": "zohocorp", "product": "manageengine_endpoint_central", "versions": [{"status": "affected", "version": "0", "lessThan": "11.3.2416.22", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "11.3.2428.10", "versionType": "custom"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-07T14:26:58.938Z"}}], "cna": {"title": "Agent Arbitrary File Deletion", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Brenden Meeder"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ManageEngine", "product": "EndPoint Central", "versions": [{"status": "affected", "version": "0", "lessThan": "11.3.2416.22", "versionType": "11.3.2416.21"}, {"status": "affected", "version": "0", "lessThan": "11.3.2428.10", "versionType": "11.3.2416.22"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.manageengine.com/products/desktop-central/cve-2024-10203.html"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.", "supportingMedia": [{"type": "text/html", "value": "Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "ManageEngine", "dateUpdated": "2024-11-07T09:20:07.450Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10203", "state": "PUBLISHED", "dateUpdated": "2024-11-07T14:27:15.677Z", "dateReserved": "2024-10-21T04:28:34.057Z", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "datePublished": "2024-11-07T09:20:07.450Z", "assignerShortName": "ManageEngine"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-10203 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-11-07T14:14:19.663318Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:zohocorp:manageengine_endpoint_central:*:*:*:*:*:*:*:* (string)

]

vendor : zohocorp (string)

product : manageengine_endpoint_central (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

lessThan : 11.3.2416.22 (string)

versionType : custom (string)

}

1 : { »

status : affected (string)

version : 0 (string)

lessThan : 11.3.2428.10 (string)

versionType : custom (string)

}

]

defaultStatus : unaffected (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-11-07T14:26:58.938Z (string)

}

]

cna : { »

title : Agent Arbitrary File Deletion (string)

source : { »

discovery : EXTERNAL (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Brenden Meeder (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : HIGH (string)

availabilityImpact : HIGH (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : ManageEngine (string)

product : EndPoint Central (string)

versions : [ »

0 : { »

status : affected (string)

version : 0 (string)

lessThan : 11.3.2416.22 (string)

versionType : 11.3.2416.21 (string)

}

1 : { »

status : affected (string)

version : 0 (string)

lessThan : 11.3.2428.10 (string)

versionType : 11.3.2416.22 (string)

}

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://www.manageengine.com/products/desktop-central/cve-2024-10203.html (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines.<br> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-269 (string)

description : CWE-269 Improper Privilege Management (string)

}

]

}

]

providerMetadata : { »

orgId : 0fc0942c-577d-436f-ae8e-945763c79b02 (string)

shortName : ManageEngine (string)

dateUpdated : 2024-11-07T09:20:07.450Z (string)

}

cveMetadata : { »

cveId : CVE-2024-10203 (string)

state : PUBLISHED (string)

dateUpdated : 2024-11-07T14:27:15.677Z (string)

dateReserved : 2024-10-21T04:28:34.057Z (string)

assignerOrgId : 0fc0942c-577d-436f-ae8e-945763c79b02 (string)

datePublished : 2024-11-07T09:20:07.450Z (string)

assignerShortName : ManageEngine (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines."}, {"lang": "es", "value": "Las versiones 11.3.2416.21 y anteriores, 11.3.2428.9 y anteriores de Zohocorp ManageEngine EndPoint Central son vulnerables a la eliminaci\u00f3n arbitraria de archivos en las m\u00e1quinas instaladas por el agente."}], "id": "CVE-2024-10203", "lastModified": "2024-11-08T19:01:03.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary"}]}, "published": "2024-11-07T10:15:05.663", "references": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "url": "https://www.manageengine.com/products/desktop-central/cve-2024-10203.html"}], "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines. (string)

}

1 : { »

lang : es (string)

value : Las versiones 11.3.2416.21 y anteriores, 11.3.2428.9 y anteriores de Zohocorp ManageEngine EndPoint Central son vulnerables a la eliminación arbitraria de archivos en las máquinas instaladas por el agente. (string)

}

]

id : CVE-2024-10203 (string)

lastModified : 2024-11-08T19:01:03.880 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1 (number)

impactScore : 5.9 (number)

source : 0fc0942c-577d-436f-ae8e-945763c79b02 (string)

type : Secondary (string)

}

]

}

published : 2024-11-07T10:15:05.663 (string)

references : [ »

0 : { »

source : 0fc0942c-577d-436f-ae8e-945763c79b02 (string)

url : https://www.manageengine.com/products/desktop-central/cve-2024-10203.html (string)

}

]

sourceIdentifier : 0fc0942c-577d-436f-ae8e-945763c79b02 (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-269 (string)

}

]

source : 0fc0942c-577d-436f-ae8e-945763c79b02 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object