CVE-2014-6043

Loading...

General

Score:6.5/10.0
Severity:Medium
Category:Access Control Error
Exploit:Available

Impact Metrics

Confidentiality:Partial
Integrity:Partial
Availability:Partial

Exploitability Metrics

Access Vector:Network
Access Complexity:Low
Authentication:Single

Published on 11/09/14 - Updated on 12/09/14

Description

ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 does not properly restrict access to the database browser, which allows remote authenticated users to obtain access to the database via a direct request to event/runQuery.do.

Category: Access Control Error

CWE-264 (Permissions, Privileges, and Access Control)
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Security Notices

US National Vulnerability DatabaseCVE-2014-6043

Exploits

Exploit-DBEDB-34519
SecurityFocusBID-69482

Relative technologies

VendorProduct
zohocorpmanageengine_eventlog_analyzer

Share this vulnerability with:

Twitter Facebook LinkedIn Mail