CVE-2015-7765
HighSummary
ZOHO ManageEngine OpManager version 11.5 build 11600 and earlier uses a hardcoded password 'plugin' for the IntegrationUser account, allowing remote authenticated users to gain administrator access by leveraging knowledge of this password.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to the system, posing a serious threat to the organization's data security.
Recommendation
It is recommended to change the password for the IntegrationUser account and update to the latest version of the software to mitigate the risk.
Other vulnerabilities in ZOHO ManageEngine OpManager
See all- CVE-2015-7766High
In ZOHO ManageEngine OpManager versions 11.6, 11.5, and earlier, remote administrators can bypass SQL query restrictions by adding a comment in the query to api/json/admin/SubmitQuery, as demonstrated by 'INSERT/**/INTO'.
- CVE-2015-9107Critical
Zoho ManageEngine OpManager versions 11 through 12.2 uses a custom encryption algorithm to protect the credentials used to access monitored devices. The implemented algorithm does not use a per-system key or even a salt, making it possible to create a universal decryptor.
Original NVD description (English source)
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.