File tree Expand file tree Collapse file tree 1 file changed +7
-7
lines changed Expand file tree Collapse file tree 1 file changed +7
-7
lines changed Original file line number Diff line number Diff line change @@ -15,13 +15,13 @@ def initialize(info = {})
15
15
super ( update_info ( info ,
16
16
'Name' => 'ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure' ,
17
17
'Description' => %q{
18
- ManageEngine Eventlog Analyzer from v7 to v9.9 b9002 has two security vulnerabilities that allow
19
- an unauthenticated user to obtain the superuser password of any managed Windows and AS/400 hosts.
20
- This module abuses both vulnerabilities to collect all the available usernames and passwords.
21
- First the agentHandler servlet is abused to get the hostid and slid of each device (CVE-2014-6038);
22
- then these numeric id's are used to extract usernames and passwords by abusing the hostdetails
23
- servlet (CVE-2014-6039).
24
- Note that on version 7 the TARGETURI has to be prepended with /event.
18
+ ManageEngine Eventlog Analyzer from v7 to v9.9 b9002 has two security vulnerabilities that
19
+ allow an unauthenticated user to obtain the superuser password of any managed Windows and
20
+ AS/400 hosts. This module abuses both vulnerabilities to collect all the available
21
+ usernames and passwords. First the agentHandler servlet is abused to get the hostid and
22
+ slid of each device (CVE-2014-6038); then these numeric id's are used to extract usernames
23
+ and passwords by abusing the hostdetails servlet (CVE-2014-6039). Note that on version 7
24
+ the TARGETURI has to be prepended with /event.
25
25
} ,
26
26
'Author' =>
27
27
[
You can’t perform that action at this time.
0 commit comments