CVE-2014-5377
ManageEngine DeviceExpert < 5.9 - Unauthenticated Exposure of Sensitive Information via ReadUsersFromMasterServlet
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-5377.
PoCs published by Pedro Ribeiro, including Metasploit module auxiliary/scanner/http/manageengine_deviceexpert_user_creds.
AI-analyzed exploit summary This exploit discloses user credentials from ManageEngine DeviceExpert 5.9 by making a GET request to an unauthenticated endpoint, returning usernames, roles, salted MD5 password hashes, and salt values in XML format.
Description
ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.
Exploits (2)
This exploit discloses user credentials from ManageEngine DeviceExpert 5.9 by making a GET request to an unauthenticated endpoint, returning usernames, roles, salted MD5 password hashes, and salt values in XML format.
This Metasploit module exploits an information disclosure vulnerability in ManageEngine DeviceExpert to extract usernames and salted MD5 password hashes. It also attempts to crack weak passwords using a predefined list.