CVE-2014-3996: SQL Injection
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90043, Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition before 7 build 7003, IT360 and IT360 Managed Service Providers (MSP) edition before 10.3.3 build 10330, and possibly other ManageEngine products, allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the sv parameter to LinkViewFetchServlet.dat.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3996?
CVE-2014-3996 is considered to have a medium severity due to its potential for SQL injection attacks.
How do I fix CVE-2014-3996?
To fix CVE-2014-3996, users should upgrade to the latest versions of ManageEngine Desktop Central, Password Manager Pro, or IT360 that are not vulnerable.
What systems are affected by CVE-2014-3996?
CVE-2014-3996 affects ManageEngine Desktop Central, Password Manager Pro, and IT360 versions below certain build numbers.
What type of vulnerability is CVE-2014-3996?
CVE-2014-3996 is a SQL injection vulnerability, allowing attackers to execute arbitrary SQL queries.
Is CVE-2014-3996 being exploited in the wild?
There is no public evidence to suggest that CVE-2014-3996 is currently being actively exploited in the wild.