Critical severity · published Jan 4, 2018
CVE-2014-7862
The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an…
9.8
CVSS
81%
EPSS
No
On KEV
Description
The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)81.0% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
Desktop Central · Zohocorp
before 90109; 7 and later · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7862
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7862
Issue Tracking
http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html
Issue Tracking
http://seclists.org/fulldisclosure/2015/Jan/2
www.securityfocus.com
http://www.securityfocus.com/archive/1/534356/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/bid/71849
Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/99595
Third Party Advisory
https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt