CVEs-PoC/2014/CVE-2014-5377.md

CVE-2014-5377

Description

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.

POC

Reference

• http://packetstormsecurity.com/files/128019/ManageEngine-DeviceExpert-5.9-Credential-Disclosure.html
• http://seclists.org/fulldisclosure/2014/Aug/75
• http://seclists.org/fulldisclosure/2014/Aug/76
• http://seclists.org/fulldisclosure/2014/Aug/84
• http://www.exploit-db.com/exploits/34449

Github

No PoCs found on GitHub currently.