← Back

CVE-2014-3997

nvd nist
Published: Dec 5, 2014Modified: May 6, 2026

JSON object

Loading...
7.5
Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P
Exploitability: 10.0 / Impact: 6.4
Source: NVD

Description

SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to MetadataServlet.dat.

Affected (79)

Zohocorp
2 products
Manageengine Password Manager Pro
Manageengine It360
Configuration A
38 vulnerable
Vulnerable SoftwareAffected Versions
Zohocorp
Manageengine Password Manager Pro
Version 5.0
Manageengine Password Manager Pro
Version 5.1
Manageengine Password Manager Pro
Version 5.2
Manageengine Password Manager Pro
Version 5.3
Manageengine Password Manager Pro
Version 5.4
Manageengine Password Manager Pro
Version 6.0
Manageengine Password Manager Pro
Version 6.0 build6002
Manageengine Password Manager Pro
Version 6.1 build6104
Manageengine Password Manager Pro
Version 6.2
Manageengine Password Manager Pro
Version 6.2 build6201
Manageengine Password Manager Pro
Version 6.3
Manageengine Password Manager Pro
Version 6.4
Manageengine Password Manager Pro
Version 6.4 build6401
Manageengine Password Manager Pro
Version 6.4 build6402
Manageengine Password Manager Pro
Version 6.4 build6403
Manageengine Password Manager Pro
Version 6.4 build6404
Manageengine Password Manager Pro
Version 6.5
Manageengine Password Manager Pro
Version 6.5 build6503
Manageengine Password Manager Pro
Version 6.5 build6504
Manageengine Password Manager Pro
Version 6.5 build6505
Manageengine Password Manager Pro
Version 6.6 build6600
Manageengine Password Manager Pro
Version 6.7 build6700
Manageengine Password Manager Pro
Version 6.7 build6701
Manageengine Password Manager Pro
Version 6.8 build6800
Manageengine Password Manager Pro
Version 6.8 build6801
Manageengine Password Manager Pro
Version 6.8 build6802
Manageengine Password Manager Pro
Version 6.8 build6803
Manageengine Password Manager Pro
Version 6.9
Manageengine Password Manager Pro
Version 6.9 build6900
Manageengine Password Manager Pro
Version 6.9 build6901
Manageengine Password Manager Pro
Version 6.9 build6902
Manageengine Password Manager Pro
Version 6.9 build6903
Manageengine Password Manager Pro
Version 6.9 build6904
Manageengine Password Manager Pro
Version 7.0
Manageengine Password Manager Pro
Version 7.0 build7000
Manageengine Password Manager Pro
Version 7.0 build7001
Manageengine Password Manager Pro
Version 7.0 build7002
Manageengine Password Manager Pro
Version 7.0 build7003
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Zohocorp
Manageengine It360
Up to 10.3.3
Manageengine It360
Up to 10.3.3
Configuration C
39 vulnerable
Vulnerable SoftwareAffected Versions
Zohocorp
Manageengine Password Manager Pro
Version 5.0
Manageengine Password Manager Pro
Version 5.1
Manageengine Password Manager Pro
Version 5.2
Manageengine Password Manager Pro
Version 5.3
Manageengine Password Manager Pro
Version 5.4
Manageengine Password Manager Pro
Version 6.0
Manageengine Password Manager Pro
Version 6.0 build6002
Manageengine Password Manager Pro
Version 6.1
Manageengine Password Manager Pro
Version 6.1 build6104
Manageengine Password Manager Pro
Version 6.2
Manageengine Password Manager Pro
Version 6.2 build6201
Manageengine Password Manager Pro
Version 6.3
Manageengine Password Manager Pro
Version 6.4
Manageengine Password Manager Pro
Version 6.4 build6401
Manageengine Password Manager Pro
Version 6.4 build6402
Manageengine Password Manager Pro
Version 6.4 build6403
Manageengine Password Manager Pro
Version 6.4 build6404
Manageengine Password Manager Pro
Version 6.5
Manageengine Password Manager Pro
Version 6.5 build6503
Manageengine Password Manager Pro
Version 6.5 build6504
Manageengine Password Manager Pro
Version 6.5 build6505
Manageengine Password Manager Pro
Version 6.6 build6600
Manageengine Password Manager Pro
Version 6.7 build6700
Manageengine Password Manager Pro
Version 6.7 build6701
Manageengine Password Manager Pro
Version 6.8 build6800
Manageengine Password Manager Pro
Version 6.8 build6801
Manageengine Password Manager Pro
Version 6.8 build6802
Manageengine Password Manager Pro
Version 6.8 build6803
Manageengine Password Manager Pro
Version 6.9
Manageengine Password Manager Pro
Version 6.9 build6900
Manageengine Password Manager Pro
Version 6.9 build6901
Manageengine Password Manager Pro
Version 6.9 build6902
Manageengine Password Manager Pro
Version 6.9 build6903
Manageengine Password Manager Pro
Version 6.9 build6904
Manageengine Password Manager Pro
Version 7.0
Manageengine Password Manager Pro
Version 7.0 build7000
Manageengine Password Manager Pro
Version 7.0 build7001
Manageengine Password Manager Pro
Version 7.0 build7002
Manageengine Password Manager Pro
Version 7.0 build7003

Related CWEs

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (8)

Source: cve@mitre.org
ExploitMailing ListThird Party Advisory
Source: cve@mitre.org
ExploitMailing ListThird Party Advisory
Source: cve@mitre.org
Exploit
Source: cve@mitre.org
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit

Timeline

No history available yet.