CVE-2014-7867: SQL Injection
First published: Thu Dec 04 2014(Updated: )
SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeName parameter.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ManageEngine OpManager MSP | =11.3 | |
| ManageEngine OpManager MSP | =11.4 | |
| ManageEngine Social IT Plus | =11.0 | |
| ManageEngine IT360 | =10.3.0 | |
| ManageEngine IT360 | =10.4 |
Remedy
https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vulnerability-fix
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-7867?
CVE-2014-7867 is classified as a medium severity SQL injection vulnerability.
How do I fix CVE-2014-7867?
To fix CVE-2014-7867, update your affected ManageEngine software to the latest version that addresses this vulnerability.
What software is affected by CVE-2014-7867?
CVE-2014-7867 affects ManageEngine OpManager versions 11.3 and 11.4, IT360 versions 10.3 and 10.4, and Social IT Plus version 11.0.
Can I exploit CVE-2014-7867 without authentication?
Yes, CVE-2014-7867 can be exploited by remote attackers without authentication to execute arbitrary SQL commands.
What are the potential impacts of CVE-2014-7867?
The potential impacts of CVE-2014-7867 include unauthorized access to sensitive data and the ability to alter database content.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/remedy
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/weakness
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/zohocorp
- canonical/manageengine opmanager msp
- version/manageengine opmanager msp/11.3
- version/manageengine opmanager msp/11.4
- canonical/manageengine social it plus
- version/manageengine social it plus/11.0
- canonical/manageengine it360
- version/manageengine it360/10.3.0
- version/manageengine it360/10.4