CVE-2015-2560

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/131062/Manage-Engine-Desktop-Central-9-Unauthorized-Administrative-Password-Reset.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/535004/100/1400/threaded
http://www.securityfocus.com/bid/73380Third Party Advisory, VDB Entry
https://www.manageengine.com/products/desktop-central/unauthorized-admin-credential-modification.htmlVendor Advisory
http://packetstormsecurity.com/files/131062/Manage-Engine-Desktop-Central-9-Unauthorized-Administrative-Password-Reset.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/535004/100/1400/threaded
http://www.securityfocus.com/bid/73380Third Party Advisory, VDB Entry
https://www.manageengine.com/products/desktop-central/unauthorized-admin-credential-modification.htmlVendor Advisory

Timeline

Published: Aug 2, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-25627.5Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd) component 1.2.5 for Joomla! allow remote attackers t CVE-2015-25637.5SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 0.9.9 and 1.2.3 allows remote attackers to execute arbitrary SQL commands CVE-2015-25646.5SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQ CVE-2015-25654.3Unspecified vulnerability in the Oracle Installed Base component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.6, 12.1.1, 12.1.2, and 1 CVE-2015-25662.8Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via vectors rel CVE-2015-25673.5Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vec CVE-2015-25685.0Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability CVE-2015-25706.5Unspecified vulnerability in the Oracle Demand Planning component in Oracle Supply Chain Products Suite 11.5.10, 12.0, 12.1, and 12.2 allows CVE-2015-25714.0Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect ava CVE-2015-25724.6Unspecified vulnerability in the Oracle Hyperion Smart View for Office component in Oracle Hyperion 11.1.2.5.216 and earlier, when running o CVE-2015-25734.0Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect ava CVE-2015-25742.1Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality via unknown vectors related to Text Utilitie