CVE-2014-5377 ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.
MediumCVSS 5.0
EPSS 57.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ManageEngine device expert | <= 5.9 | No fix listed |
References
- packetstormsecurity.com exploit
- 20140827 [The ManageOwnage Series, part II]: User credential disclosure in ManageEngine DeviceExpert mailing-list
- 20140827 Re: [The ManageOwnage Series, part II]: User credential disclosure in ManageEngine DeviceExpert exploit mailing-list
- 20140830 Re: [The ManageOwnage Series, part II]: User credential disclosure in ManageEngine DeviceExpert mailing-list
- 34449 exploit
- www.manageengine.com patch
- 20140827 [The ManageOwnage Series, part II]: User credential disclosure in ManageEngine DeviceExpert mailing-list
- 69443 vdb-entry
- deviceexpert-cve20145377-info-disc(95562) vdb-entry
- raw.githubusercontent.com exploit