CVE-2014-7862

🗓️ 04 Jan 2018 17:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 95 Views🌐 WEB

ManageEngine Desktop Central CVE-2014-7862 vulnerability

Reporter	Title	Published	Views	Family All 20
zdt	ManageEngine Desktop Central Administrator Account Creation Exploit	6 Jan 201500:00	–	zdt
zdt	ManageEngine Desktop Central - Create Administrator Vulnerability	26 Jan 201800:00	–	zdt
BDU FSTEC	The vulnerability of the DCPluginServelet Servlet component of the software for managing workstations via the web interface of ManageEngine Desktop Central, along with its remote monitoring and management capabilities for desktop PCs, servers, laptops, and mobile devices under ManageEngine Endpoint Central MSP (formerly ManageEngine Desktop Central MSP), allows a malicious individual to circumvent existing security restrictions.	10 Oct 202500:00	–	bdu_fstec
Circl	CVE-2014-7862	29 May 201815:50	–	circl
CNVD	ManageEngine Desktop Central Remote Security Bypass Vulnerability	4 Jan 201500:00	–	cnvd
Check Point Advisories	ManageEngine Desktop Central Dcpluginservelet Policy Bypass (CVE-2014-7862)	12 Jan 201500:00	–	checkpoint_advisories
Cvelist	CVE-2014-7862	4 Jan 201817:00	–	cvelist
Exploit DB	ManageEngine Desktop Central - Create Administrator	15 Jan 201500:00	–	exploitdb
exploitpack	ManageEngine Desktop Central - Create Administrator	15 Jan 201500:00	–	exploitpack
Tenable Nessus	ManageEngine Desktop Central Remote Security Bypass (Intrusive Check)	25 Mar 201500:00	–	nessus

NVD

Node

zohocorp desktop_centralRange<90109managed_service_providers

zohocorp desktop_centralRange7≥

Source	Link
seclists	www.seclists.org/fulldisclosure/2015/Jan/2
securityfocus	www.securityfocus.com/archive/1/534356/100/0/threaded
rapid7	www.rapid7.com/db/modules/auxiliary/admin/http/manage_engine_dc_create_admin
packetstormsecurity	www.packetstormsecurity.com/files/129769/Desktop-Central-Add-Administrator.html
manageengine	www.manageengine.com/products/desktop-central/cve20147862-unauthorized-account-creation.html
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/99595
securityfocus	www.securityfocus.com/bid/71849
github	www.github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt

Parameter	Position	Path	Description	CWE
action	query param	/servlets/DCPluginServelet	Exploitation endpoint DCPluginServelet with action=addPlugInUser allows remote creation of an administrator account via crafted GET request with user details and password hash.	CWE-264
role	query param	/servlets/DCPluginServelet	Exploitation endpoint DCPluginServelet with action=addPlugInUser allows remote creation of an administrator account via crafted GET request with user details and password hash.	CWE-264
userName	query param	/servlets/DCPluginServelet	Exploitation endpoint DCPluginServelet with action=addPlugInUser allows remote creation of an administrator account via crafted GET request with user details and password hash.	CWE-264
email	query param	/servlets/DCPluginServelet	Exploitation endpoint DCPluginServelet with action=addPlugInUser allows remote creation of an administrator account via crafted GET request with user details and password hash.	CWE-264
phNumber	query param	/servlets/DCPluginServelet	Exploitation endpoint DCPluginServelet with action=addPlugInUser allows remote creation of an administrator account via crafted GET request with user details and password hash.	CWE-264
password	query param	/servlets/DCPluginServelet	Exploitation endpoint DCPluginServelet with action=addPlugInUser allows remote creation of an administrator account via crafted GET request with user details and password hash.	CWE-264
salt	query param	/servlets/DCPluginServelet	Exploitation endpoint DCPluginServelet with action=addPlugInUser allows remote creation of an administrator account via crafted GET request with user details and password hash.	CWE-264
createdtime	query param	/servlets/DCPluginServelet	Exploitation endpoint DCPluginServelet with action=addPlugInUser allows remote creation of an administrator account via crafted GET request with user details and password hash.	CWE-264

17 Jun 2026 00:15Current

9.2Critical risk

Vulners AI Score9.2

CVSS 27.5

CVSS 39.8

EPSS0.81048

CWE-264