CVE-2015-7765

ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

67.28% chance of exploitation in the next 30 days, 99th percentile

Published

2015-10-09

Updated

2024-09-17

Proof-of-concept exploits (1)

• http://www.rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manage_engine_opman…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/38221

References

• CVE Record
• NVD entry

Related

• CVE-2015-7755
• CVE-2015-7766
• CVE-2015-7744
• CVE-2015-7767
• CVE-2015-7743
• CVE-2015-7768