CVE-2014-9331

ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery

Severity Score

6.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATE_ID/1417736606982/roleMgmt.do.

Vulnerabilidad de CSRF en ZOHO ManageEngine Desktop Central anterior a 9 build 90130 permite a atacantes remotos secuestrar la autenticación de administradores para solicitudes que añaden una cuenta de administrador a través de una acción addUser en STATE_ID/1417736606982/roleMgmt.do.

*Credits: N/A

CVSS Scores

NISTv2 6.8

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-12-07 CVE Reserved
2015-02-03 CVE Published
2015-02-03 First Exploit
2023-08-30 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-352: Cross-Site Request Forgery (CSRF)

CAPEC

References (6)

URL	Tag	Source
http://www.securityfocus.com/archive/1/534604/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/72464	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/35980	2015-02-03
http://packetstormsecurity.com/files/130219/ManageEngine-Desktop-Central-9-Cross-Site-Request-Forgery.html	2024-08-06
http://www.exploit-db.com/exploits/35980	2024-08-06

URL	Date	SRC
http://www.manageengine.com/products/desktop-central/cve20149331-cross-site-request-forgery.html	2018-10-09

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Zohocorp Search vendor "Zohocorp"		Manageengine Desktop Central Search vendor "Zohocorp" for product "Manageengine Desktop Central"				<= 9.0 Search vendor "Zohocorp" for product "Manageengine Desktop Central" and version " <= 9.0"		-		Affected