CVE-2014-7862

EPSS 81.0%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 81.0%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

31 Dec 2014Metasploit module available

15 Jan 2015Public PoC

04 Jan 2018Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.htmlunverified exploitdbwww.exploit-db.com/exploits/43892unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html http://seclists.org/fulldisclosure/2015/Jan/2 https://exchange.xforce.ibmcloud.com/vulnerabilities/99595 https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt https://www.manageengine.com/products/desktop-central/cve20147862-unauthorized-account-creation.html https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin http://www.securityfocus.com/archive/1/534356/100/0/threaded http://www.securityfocus.com/bid/71849