CVE-2014-5377

Published: Sep 4, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.

Affected (1)

Products: Manageengine: Device Expert

Manageengine

1 product

Device Expert

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Manageengine Device Expert	Up to 5.9

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (20)

http://packetstormsecurity.com/files/128019/ManageEngine-DeviceExpert-5.9-Credential-Disclosure.html

Source: cve@mitre.org

Exploit

http://seclists.org/fulldisclosure/2014/Aug/75

Source: cve@mitre.org

http://seclists.org/fulldisclosure/2014/Aug/76

Source: cve@mitre.org

Exploit

http://seclists.org/fulldisclosure/2014/Aug/84

Source: cve@mitre.org

http://www.exploit-db.com/exploits/34449

Source: cve@mitre.org

Exploit

http://www.manageengine.com/products/device-expert/release-notes.html

Source: cve@mitre.org

Patch

http://www.securityfocus.com/archive/1/533250/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/69443

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/95562

Source: cve@mitre.org

https://raw.githubusercontent.com/pedrib/PoC/master/me_deviceexpert-5.txt

Source: cve@mitre.org

Exploit

http://packetstormsecurity.com/files/128019/ManageEngine-DeviceExpert-5.9-Credential-Disclosure.html