published January 4, 2018
NVD has not assigned a CVSS score to this record. It sits in the 99.6th percentile for exploit probability.
🚨 A sneaky little endpoint allows attackers to create admin accounts without breaking a sweat! Just a single action can give them the keys to the kingdom. 🔥 Think of it like a hotel check-in where anyone can walk up and request a master key — no verification needed! If a rogue guest can waltz in and get access to any room, chaos would surely follow. An attacker exploiting this vulnerability could easily set themselves up as an administrator, allowing them to control settings, access sensitive data, or even disable security measures. Imagine the mayhem if your IT department suddenly found themselves locked out of their systems!
Think of it like a hotel check-in where anyone can walk up and request a master key — no verification needed! If a rogue guest can waltz in and get access to any room, chaos would surely follow. This vulnerability in the DCPluginServlet of ManageEngine Desktop Central before build 90109 allows remote attackers to invoke an addPlugInUser action, which can create new administrator accounts without proper authorization checks.
An attacker exploiting this vulnerability could easily set themselves up as an administrator, allowing them to control settings, access sensitive data, or even disable security measures. Imagine the mayhem if your IT department suddenly found themselves locked out of their systems! To protect your environment, upgrade to at least build 90109 immediately. Review your user accounts too, ensuring no unauthorized accounts exist, and consider implementing additional access control measures. You’ve got this! Just follow these steps, and you’ll have that server locked down in no time! 🛡️