CVE-2014-7862

EUVD-2014-7712
The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Affected Products (NVD)
VendorProductVersion
zohocorpdesktop_central
𝑥
< 90109
zohocorpdesktop_central
7 ≤
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html
http://seclists.org/fulldisclosure/2015/Jan/2
http://www.securityfocus.com/archive/1/534356/100/0/threaded
http://www.securityfocus.com/bid/71849
https://exchange.xforce.ibmcloud.com/vulnerabilities/99595
https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt
https://www.manageengine.com/products/desktop-central/cve20147862-unauthorized-account-creation.html
https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin
http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html
http://seclists.org/fulldisclosure/2015/Jan/2
http://www.securityfocus.com/archive/1/534356/100/0/threaded
http://www.securityfocus.com/bid/71849
https://exchange.xforce.ibmcloud.com/vulnerabilities/99595
https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt
https://www.manageengine.com/products/desktop-central/cve20147862-unauthorized-account-creation.html
https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin