CVE-2014-7862

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• ManageEngine Desktop Central - Create Administrator2015-01-15 · webapps · multiple

Impact

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html
• http://seclists.org/fulldisclosure/2015/Jan/2
• http://www.securityfocus.com/archive/1/534356/100/0/threaded
• http://www.securityfocus.com/bid/71849
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99595
• https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt
• https://www.manageengine.com/products/desktop-central/cve20147862-unauthorized-account-creation.html
• https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin
• http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html
• http://seclists.org/fulldisclosure/2015/Jan/2
• http://www.securityfocus.com/archive/1/534356/100/0/threaded
• http://www.securityfocus.com/bid/71849
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99595
• https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt
• https://www.manageengine.com/products/desktop-central/cve20147862-unauthorized-account-creation.html
• https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin