CVE-2014-7862

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-01-04

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Desktop Central (Zohocorp)

References

• http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html
• http://seclists.org/fulldisclosure/2015/Jan/2
• http://www.securityfocus.com/archive/1/534356/100/0/threaded
• http://www.securityfocus.com/bid/71849
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99595
• https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt
• https://www.manageengine.com/products/desktop-central/cve20147862-unauthorized-account-creation.html
• https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin