CVE-2014-3996

high · 7.5

SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to LinkViewFetchServlet.dat.

7.5

CVSS

38.4%

EPSS (exploit prob.)

99th

EPSS percentile

2014-12-05

Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
manageengine	it360	<= 10.3.3
manageengine	it360	<= 10.3.3
manageengine	password_manager_pro	<= 7.0
manageengine	password_manager_pro	<= 7.0
manageengine	desktop_central	<= 9.0
manageengine	desktop_central	<= 9.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-3996