CVE Catalog
CVE-2015-2560
CriticalSummary
Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet.
Risk Assessment
Attackers can gain full access to administrator accounts, potentially leading to serious security breaches in the system.
Recommendation
It is recommended to upgrade to version 90135 or later to secure the system against this vulnerability.
Original NVD description (English source)
Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet.