ManageEngine DeviceExpert CVE-2014-5377 User Credentials Information Disclosure Vulnerability

Bugtraq ID:	69443
Class:	Design Error
CVE:	CVE-2014-5377
Remote:	Yes
Local:	No
Published:	Aug 27 2014 12:00AM
Updated:	Sep 02 2014 12:23AM
Credit:	Pedro Ribeiro
Vulnerable:
Not Vulnerable:

ManageEngine DeviceExpert CVE-2014-5377 User Credentials Information Disclosure Vulnerability

ManageEngine DeviceExpert is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to obtain potentially sensitive information. Information obtained may aid in further attacks.

ManageEngine DeviceExpert 5.9 Build 5980 is vulnerable; other versions may also be affected.

ManageEngine DeviceExpert CVE-2014-5377 User Credentials Information Disclosure Vulnerability

Attackers can use a browser to exploit this issue.

The following example request is available:

GET /ReadUsersFromMasterServlet

ManageEngine DeviceExpert CVE-2014-5377 User Credentials Information Disclosure Vulnerability

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

ManageEngine DeviceExpert CVE-2014-5377 User Credentials Information Disclosure Vulnerability

References:

• ManageEngine DeviceExpert Homepage (Zoho Corporation)