CVE-2014-7862

The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.

CVSS v3.0 NVD

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

81.05% chance of exploitation in the next 30 days, 100th percentile

Published

2018-01-04

Updated

2024-08-06

Proof-of-concept exploits (1)

• pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt862★ · 2025-04-16

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/manage_engine_dc_cre…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/43892

Security advisories

• http://packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html
• http://seclists.org/fulldisclosure/2015/Jan/2
• http://www.securityfocus.com/bid/71849
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99595
• https://www.manageengine.com/products/desktop-central/cve20147862-unauthorized-account-cr…
• https://www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin

References

• CVE Record
• NVD entry

Related

• CVE-2014-1201
• CVE-2014-1836
• CVE-2014-2921
• CVE-2014-2922
• CVE-2016-6598
• CVE-2016-6599