CVE-2015-2560

🗓️ 02 Aug 2017 19:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 77 Views🌐 WEB

Manage Engine Desktop Central 9 before build 90135 - CVE-2015-256

Reporter	Title	Published	Views	Family All 10
zdt	Manage Engine Desktop Central 9 Unauthorized Administrative Password Reset Vulnerability	28 Mar 201500:00	–	zdt
CNVD	ManageEngine Desktop Central Password Reset Security Bypass Vulnerability	11 May 201800:00	–	cnvd
Check Point Advisories	ManageEngine Desktop Central Unauthorized Administrative Password Reset (CVE-2015-2560)	6 Apr 201500:00	–	checkpoint_advisories
Cvelist	CVE-2015-2560	2 Aug 201719:00	–	cvelist
Tenable Nessus	ManageEngine Desktop Central < 9 Build 90135 Unauthenticated Admin Password Reset	31 Mar 201500:00	–	nessus
NVD	CVE-2015-2560	2 Aug 201719:29	–	nvd
Packet Storm	Manage Engine Desktop Central 9 Unauthorized Administrative Password Reset	27 Mar 201500:00	–	packetstorm
Prion	Design/Logic Flaw	2 Aug 201719:29	–	prion
securityvulns	Manage Engine Desktop Central 9 - CVE-2015-2560 - Unauthorised administrative password reset	12 May 201500:00	–	securityvulns
securityvulns	Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)	12 May 201500:00	–	securityvulns

NVD

Node

zohocorp manageengine_desktop_centralMatch9.0

Source	Link
manageengine	www.manageengine.com/products/desktop-central/unauthorized-admin-credential-modification.html
securityfocus	www.securityfocus.com/bid/73380
packetstormsecurity	www.packetstormsecurity.com/files/131062/Manage-Engine-Desktop-Central-9-Unauthorized-Administrative-Password-Reset.html
securityfocus	www.securityfocus.com/archive/1/535004/100/1400/threaded

Parameter	Position	Path	Description	CWE
operation	query param	/servlets/DCOperationsServlet?operation=addOrModifyUser&roleId=DCAdmin&userName=admin&password=admin3	Remote unauthenticated modification of an Administrator account password via DCOperationsServlet addOrModifyUser	CWE-264
roleId	query param	/servlets/DCOperationsServlet?operation=addOrModifyUser&roleId=DCAdmin&userName=admin&password=admin3	Remote unauthenticated modification of an Administrator account password via DCOperationsServlet addOrModifyUser	CWE-264
userName	query param	/servlets/DCOperationsServlet?operation=addOrModifyUser&roleId=DCAdmin&userName=admin&password=admin3	Remote unauthenticated modification of an Administrator account password via DCOperationsServlet addOrModifyUser	CWE-264
password	query param	/servlets/DCOperationsServlet?operation=addOrModifyUser&roleId=DCAdmin&userName=admin&password=admin3	Remote unauthenticated modification of an Administrator account password via DCOperationsServlet addOrModifyUser	CWE-264

17 Jun 2026 00:24Current

9.3High risk

Vulners AI Score9.3

CVSS 25

CVSS 39.8

EPSS0.15209

manage engine desktop central 9 cve-2015-2560 password change vulnerability nvd security issue