CVE-2013-7390: ManageEngine DesktopCentral unrestricted JSP file upload RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a 9.8 CVSS score and very high EPSS probability, with public exploit code available.

What it is

ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 exposes AgentLogUploadServlet, which accepts uploaded files without restricting their type. An attacker can upload a JSP file and then request it directly from the webroot, causing the server to execute it as code. The flaw is remotely reachable without authentication or user interaction and carries a CVSS 3.1 base score of 9.8.

Impact

Successful exploitation gives the attacker arbitrary code execution in the context of the DesktopCentral web service, typically leading to full compromise of the host and any managed endpoints it administers.

Attack surface

Reached over the network via HTTP against AgentLogUploadServlet; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.74528 (99.47th percentile) and public references include an exploit write-up and a Metasploit module, indicating mature, widely available exploitation.

What to do

• Upgrade DesktopCentral to build 80293 or later, or to a currently supported release, as the primary fix.
• If upgrade is not immediately possible, restrict network access to the DesktopCentral web interface to trusted management hosts only.
• Block or reject uploads with executable extensions such as .jsp at the reverse proxy or WAF in front of the servlet.
• Remove execute permissions for script extensions in the webroot and verify no attacker-uploaded files remain.
• Audit the webroot and logs for unexpected JSP files or requests to uploaded paths.

Detection

• Monitor HTTP requests to AgentLogUploadServlet and subsequent direct GET requests for .jsp files in the webroot.
• Alert on new or modified .jsp files appearing in DesktopCentral web directories.
• Review web server and application logs for uploads followed by immediate access from the same source IP.
• Hunt for known Metasploit module traffic patterns against DesktopCentral endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.