CVE-2014-3997

Exploit

EPSS 13.05%
Veröffentlicht 05.12.2014 15:59:01
Zuletzt bearbeitet 06.05.2026 22:30:45
Erkennungen
Login

SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to MetadataServlet.dat.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 7

NVD 79 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Zohocorp ≫ Manageengine Password Manager Pro Version 5.0 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 5.1 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 5.2 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 5.3 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 5.4 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.0 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.0 Update build6002 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.1 Update build6104 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.2 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.2 Update build6201 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.3 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.4 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.4 Update build6401 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.4 Update build6402 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.4 Update build6403 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.4 Update build6404 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.5 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.5 Update build6503 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.5 Update build6504 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.5 Update build6505 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.6 Update build6600 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.7 Update build6700 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.7 Update build6701 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.8 Update build6800 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.8 Update build6801 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.8 Update build6802 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.8 Update build6803 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.9 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.9 Update build6900 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.9 Update build6901 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.9 Update build6902 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.9 Update build6903 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 6.9 Update build6904 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 7.0 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 7.0 Update build7000 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 7.0 Update build7001 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 7.0 Update build7002 SwEdition -

Zohocorp ≫ Manageengine Password Manager Pro Version 7.0 Update build7003 SwEdition -

Zohocorp ≫ Manageengine It360 SwEdition - Version <= 10.3.3

Zohocorp ≫ Manageengine It360 SwEdition managed_service_providers Version <= 10.3.3

Zohocorp ≫ Manageengine Password Manager Pro Version 5.0 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 5.1 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 5.2 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 5.3 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 5.4 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.0 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.0 Update build6002 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.1 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.1 Update build6104 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.2 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.2 Update build6201 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.3 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.4 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.4 Update build6401 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.4 Update build6402 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.4 Update build6403 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.4 Update build6404 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.5 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.5 Update build6503 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.5 Update build6504 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.5 Update build6505 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.6 Update build6600 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.7 Update build6700 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.7 Update build6701 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.8 Update build6800 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.8 Update build6801 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.8 Update build6802 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.8 Update build6803 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.9 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.9 Update build6900 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.9 Update build6901 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.9 Update build6902 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.9 Update build6903 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 6.9 Update build6904 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 7.0 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 7.0 Update build7000 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 7.0 Update build7001 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 7.0 Update build7002 SwEdition managed_service_providers

Zohocorp ≫ Manageengine Password Manager Pro Version 7.0 Update build7003 SwEdition managed_service_providers

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	13.05%	0.96

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

http://seclists.org/fulldisclosure/2014/Aug/55

Third Party Advisory

Exploit

Mailing List

http://seclists.org/fulldisclosure/2014/Aug/85

Third Party Advisory

Exploit

Mailing List

https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc_pmp_it360_sqli.txt

Exploit

https://raw.githubusercontent.com/pedrib/PoC/master/msf_modules/manageengine_dc_pmp_sqli.rb

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2014-3997

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-3997

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-3997

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2014-3997