Skip to content

Commit e99cc00

Browse files
committed
No more than 100 columns on description
1 parent c00a3ac commit e99cc00

File tree

1 file changed

+7
-7
lines changed

1 file changed

+7
-7
lines changed

modules/auxiliary/gather/eventlog_cred_disclosure.rb

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,13 @@ def initialize(info = {})
1515
super(update_info(info,
1616
'Name' => 'ManageEngine Eventlog Analyzer Managed Hosts Administrator Credential Disclosure',
1717
'Description' => %q{
18-
ManageEngine Eventlog Analyzer from v7 to v9.9 b9002 has two security vulnerabilities that allow
19-
an unauthenticated user to obtain the superuser password of any managed Windows and AS/400 hosts.
20-
This module abuses both vulnerabilities to collect all the available usernames and passwords.
21-
First the agentHandler servlet is abused to get the hostid and slid of each device (CVE-2014-6038);
22-
then these numeric id's are used to extract usernames and passwords by abusing the hostdetails
23-
servlet (CVE-2014-6039).
24-
Note that on version 7 the TARGETURI has to be prepended with /event.
18+
ManageEngine Eventlog Analyzer from v7 to v9.9 b9002 has two security vulnerabilities that
19+
allow an unauthenticated user to obtain the superuser password of any managed Windows and
20+
AS/400 hosts. This module abuses both vulnerabilities to collect all the available
21+
usernames and passwords. First the agentHandler servlet is abused to get the hostid and
22+
slid of each device (CVE-2014-6038); then these numeric id's are used to extract usernames
23+
and passwords by abusing the hostdetails servlet (CVE-2014-6039). Note that on version 7
24+
the TARGETURI has to be prepended with /event.
2525
},
2626
'Author' =>
2727
[

0 commit comments

Comments
 (0)