ManageEngine EventLog Analyzer CVE-2014-6038 Information Disclosure Vulnerability

Bugtraq ID:	70959
Class:	Design Error
CVE:	CVE-2014-6038
Remote:	Yes
Local:	No
Published:	Nov 05 2014 12:00AM
Updated:	Nov 05 2014 12:00AM
Credit:	Pedro Ribeiro
Vulnerable:	ManageEngine Eventlog Analyzer 9.9 Build 9002 ManageEngine Eventlog Analyzer 9.9 ManageEngine Eventlog Analyzer 8.6 ManageEngine Eventlog Analyzer 7
Not Vulnerable:

ManageEngine EventLog Analyzer CVE-2014-6038 Information Disclosure Vulnerability

EventLog Analyzer is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks.

EventLog Analyzer 7 through 9.9 build 9002 are vulnerable.

ManageEngine EventLog Analyzer CVE-2014-6038 Information Disclosure Vulnerability

An attacker can exploit this issue using a web browser.

The following metasploit module is available:

• /data/vulnerabilities/exploits/70959.rb

ManageEngine EventLog Analyzer CVE-2014-6038 Information Disclosure Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

ManageEngine EventLog Analyzer CVE-2014-6038 Information Disclosure Vulnerability

References:

• Event LogAnalyzer Homepage (ManageEngine)
  
• [The ManageOwnage Series, part VI]: 0day database info and superuser credential (SecLists.Org)