PT-2018-4293 · Zoho · Manageengine Desktop Central

Pedro Ribeiro · Publicado 2018-01-04 · Atualizado 2018-10-09 · CVE-2014-7862

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ManageEngine Desktop Central versions prior to build 90109 ManageEngine Desktop Central MSP versions prior to build 90109

Description The issue allows remote attackers to create administrator accounts. This is achieved through the DCPluginServelet servlet via an addPlugInUser action.

Recommendations For ManageEngine Desktop Central versions prior to build 90109, update to build 90109 or later. For ManageEngine Desktop Central MSP versions prior to build 90109, update to build 90109 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2025-12730

CVE-2014-7862

Produtos afetados

Manageengine Desktop Central

Referências · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb · Exploit
• 🔥 https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt · Exploit
• 🔥 https://exploit-db.com/exploits/43892 · Exploit
• 🔥 https://rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin · Exploit
• https://manageengine.com/products/desktop-central/cve20147862-unauthorized-account-creation.html · Nota
• http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html · Nota
• https://securitycode.ru/company/blog/daydzhest-laboratorii-analiza-setevykh-ugroz-kod-bezopasnosti-za-mart-2025 · Nota
• https://seclists.org/fulldisclosure/2015/Jan/2 · Nota
• http://securityfocus.com/bid/71849 · Nota
• http://seclists.org/fulldisclosure/2015/Jan/2 · Nota
• http://securityfocus.com/archive/1/534356/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-7862 · Nota de Segurança
• https://bdu.fstec.ru/vul/2025-12730 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99595 · Nota