CVE-2014-5377

MEDIUM 5.0CVE-2014-5377 · Published 04/09/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
device expert manageengine	`≤ 5.9`	No fix yet

Description

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.

References

packetstormsecurity.com/files/128019/ManageEngine-DeviceExpert-5.9-Credential-Disclosure.html · Exploit
seclists.org/fulldisclosure/2014/Aug/75
seclists.org/fulldisclosure/2014/Aug/76 · Exploit
seclists.org/fulldisclosure/2014/Aug/84
exploit-db.com/exploits/34449 · Exploit
manageengine.com/products/device-expert/release-notes.html · Patch
securityfocus.com/archive/1/533250/100/0/threaded
securityfocus.com/bid/69443
exchange.xforce.ibmcloud.com/vulnerabilities/95562
raw.githubusercontent.com/pedrib/PoC/master/me_deviceexpert-5.txt · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free