PT-2015-7595 · Zoho · Zoho Manageengine Opmanager

Xistence · Published 2015-10-09 · Updated 2015-10-09 · CVE-2015-7765

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ZOHO ManageEngine OpManager versions 11.5 build 11600 and earlier

Description The issue allows remote authenticated users to obtain administrator access by leveraging knowledge of a hardcoded password. The hardcoded password is used for the IntegrationUser account.

Recommendations For ZOHO ManageEngine OpManager versions 11.5 build 11600 and earlier, change the hardcoded password plugin for the IntegrationUser account to a unique and secure password to prevent unauthorized access. As a temporary workaround, consider restricting access to the IntegrationUser account until a secure password is set.

Exploit

Fix

Related Identifiers

CVE-2015-7765

Affected Products

Zoho Manageengine Opmanager

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manage_engine_opmanager_rce.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/133596/ManageEngine-OpManager-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/38221 · Exploit
• 🔥 http://rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7765 · Security Note
• https://support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability · Note
• http://seclists.org/fulldisclosure/2015/Sep/66 · Note