CVE-2014-7867: SQL Injection

Published Dec 4, 2014

Updated

SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeName parameter.

Affected Software

5 affected components

ZohoCorp ManageEngine OpManager=11.3

ZohoCorp ManageEngine OpManager=11.4

Zohocorp Manageengine Social It Plus=11.0

Zohocorp Manageengine It360=10.3.0

Zohocorp Manageengine It360=10.4

Remediation

Patch Available

https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vulnerability-fix

Event History

Dec 4, 2014

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-7867?

CVE-2014-7867 is classified as a medium severity SQL injection vulnerability.

How do I fix CVE-2014-7867?

To fix CVE-2014-7867, update your affected ManageEngine software to the latest version that addresses this vulnerability.

What software is affected by CVE-2014-7867?

CVE-2014-7867 affects ManageEngine OpManager versions 11.3 and 11.4, IT360 versions 10.3 and 10.4, and Social IT Plus version 11.0.

Can I exploit CVE-2014-7867 without authentication?

Yes, CVE-2014-7867 can be exploited by remote attackers without authentication to execute arbitrary SQL commands.

What are the potential impacts of CVE-2014-7867?

The potential impacts of CVE-2014-7867 include unauthorized access to sensitive data and the ability to alter database content.