CVE-2014-5377 : ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 al

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.

Published 2014-09-04 17:55:07

Updated 2018-10-09 19:50:14

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2014-5377

Manageengine » Device Expert
Versions up to, including, (<=) 5.9
cpe:2.3:a:manageengine:device_expert:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-5377

EPSS FAQ

20.00%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 96 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2014-5377

ManageEngine DeviceExpert User Credentials

Disclosure Date: 2014-08-28

First seen: 2020-04-26

auxiliary/scanner/http/manageengine_deviceexpert_user_creds

This module extracts usernames and salted MD5 password hashes from ManageEngine DeviceExpert version 5.9 build 5980 and prior. This module has been tested successfully on DeviceExpert version 5.9.7 build 5970. Authors: - Pedro Ribeiro <pedrib@gmail.com> -

More information

CVSS scores for CVE-2014-5377

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2014-5377

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-5377

http://seclists.org/fulldisclosure/2014/Aug/75

Full Disclosure: [The ManageOwnage Series, part II]: User credential disclosure in ManageEngine DeviceExpert
http://seclists.org/fulldisclosure/2014/Aug/76

Full Disclosure: Re: [The ManageOwnage Series, part II]: User credential disclosure in ManageEngine DeviceExpert
Exploit
http://seclists.org/fulldisclosure/2014/Aug/84

Full Disclosure: Re: [The ManageOwnage Series, part II]: User credential disclosure in ManageEngine DeviceExpert
https://exchange.xforce.ibmcloud.com/vulnerabilities/95562

ManageEngine DeviceExpert information disclosure CVE-2014-5377 Vulnerability Report
http://www.manageengine.com/products/device-expert/release-notes.html

Release Notes - New Features | NCM - ManageEngine
Patch
http://www.exploit-db.com/exploits/34449

ManageEngine DeviceExpert 5.9 - User Credential Disclosure - Multiple webapps Exploit
Exploit
https://raw.githubusercontent.com/pedrib/PoC/master/me_deviceexpert-5.txt

Exploit
http://www.securityfocus.com/bid/69443

ManageEngine DeviceExpert CVE-2014-5377 User Credentials Information Disclosure Vulnerability
http://packetstormsecurity.com/files/128019/ManageEngine-DeviceExpert-5.9-Credential-Disclosure.html

ManageEngine DeviceExpert 5.9 Credential Disclosure ≈ Packet Storm
Exploit
http://www.securityfocus.com/archive/1/533250/100/0/threaded

SecurityFocus

Jump to