Vulnerability Description
The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.
CVSS Score
9.8
CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | Desktop Central | < 90109 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.htIssue TrackingThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2015/Jan/2Issue TrackingMailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/534356/100/0/threaded
- http://www.securityfocus.com/bid/71849Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99595Issue TrackingThird Party AdvisoryVDB Entry
- https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.tThird Party Advisory
- https://www.manageengine.com/products/desktop-central/cve20147862-unauthorized-aThird Party Advisory
- https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_aExploitThird Party Advisory
- http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.htIssue TrackingThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2015/Jan/2Issue TrackingMailing ListThird Party Advisory
- http://www.securityfocus.com/archive/1/534356/100/0/threaded
- http://www.securityfocus.com/bid/71849Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99595Issue TrackingThird Party AdvisoryVDB Entry
- https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.tThird Party Advisory
- https://www.manageengine.com/products/desktop-central/cve20147862-unauthorized-aThird Party Advisory
FAQ
What is CVE-2014-7862?
CVE-2014-7862 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.
How severe is CVE-2014-7862?
CVE-2014-7862 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2014-7862?
Check the references section above for vendor advisories and patch information. Affected products include: Zohocorp Desktop Central.