CVEvulnerability

CVE-2015-7765

9.0 HIGH Published 2015-10-09 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2015-10-09
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 2.0 ([email protected]): 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C

Description

ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser account, which allows remote authenticated users to obtain administrator access by leveraging knowledge of this password.

Affected configurations

• zohocorp manageengine opmanager 11.5

References

http://packetstormsecurity.com/files/133596/ManageEngine-OpManager-Remote-Code-Execution.html Exploit
http://seclists.org/fulldisclosure/2015/Sep/66 seclists.org
http://www.rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce Exploit
https://support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability support.zoho.com
https://www.exploit-db.com/exploits/38221/ Exploit
http://packetstormsecurity.com/files/133596/ManageEngine-OpManager-Remote-Code-Execution.html Exploit
http://seclists.org/fulldisclosure/2015/Sep/66 seclists.org
http://www.rapid7.com/db/modules/exploit/windows/http/manage_engine_opmanager_rce Exploit
https://support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability support.zoho.com
https://www.exploit-db.com/exploits/38221/ Exploit