CVE-2014-9331: Zohocorp ManageEngine Desktop Central

Medium severity, CVSS 6.8. EPSS: 4.6% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in ZOHO ManageEngine Desktop Central before 9 build 90130 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an addUser action to STATE_ID/1417736606982/roleMgmt.do.

Affected products

• Zohocorp ManageEngine Desktop Central: up to and including 9.0

Published 2015-02-04. Last modified 2026-06-17.