CVE-2015-2560 Privilege escalation in n/a

Critical 9.8 Published 2 Aug 2017 Updated 6 Aug 2024

Remote attackers can escalate privileges to Administrator by modifying user passwords via a specific servlet operation in Manage Engine Desktop Central.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2015-2560?

CVE-2015-2560 is a critical vulnerability in n/a, published on 2 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet.

Weakness: CWE-264

Which versions are affected by CVE-2015-2560?

It affects 1 product.

Products include Zohocorp Manageengine Desktop Central.

How do I fix CVE-2015-2560?

No fix has been published for CVE-2015-2560 yet. Limit exposure of the affected software until one is available.

Is CVE-2015-2560 being exploited?

There is no known exploitation of CVE-2015-2560 in the wild and no public exploit code.

Sources

Also known as GHSA-x3r9-8qrf-5hff.