CVE-2015-5459: SQL Injection

Q: What is the severity of CVE-2015-5459?

CVE-2015-5459 is classified as a medium severity SQL injection vulnerability.

Q: How do I fix CVE-2015-5459?

To fix CVE-2015-5459, upgrade ManageEngine Password Manager Pro to version 8.1 Build 8101 or later.

Q: Who is affected by CVE-2015-5459?

CVE-2015-5459 affects ManageEngine Password Manager Pro versions prior to 8.1 Build 8101.

Q: What type of vulnerability is CVE-2015-5459?

CVE-2015-5459 is an SQL injection vulnerability that allows execution of arbitrary SQL commands.

Q: Can CVE-2015-5459 be exploited remotely?

Yes, CVE-2015-5459 can be exploited remotely by authenticated users to execute SQL commands.

Published Jul 8, 2015

Updated

SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build 8101 allows remote authenticated users to execute arbitrary SQL commands via the ANDOR parameter, as demonstrated by a request to STATEID/1425543888647/SQLAdvancedALSearchResult.cc.

Affected Software

1 affected component

ZohoCorp ManageEngine Password Manager Pro<=8.1

Remediation

Patch Available

https://www.manageengine.com/products/passwordmanagerpro/release-notes.html

Event History

Jul 8, 2015

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-5459?

CVE-2015-5459 is classified as a medium severity SQL injection vulnerability.

How do I fix CVE-2015-5459?

To fix CVE-2015-5459, upgrade ManageEngine Password Manager Pro to version 8.1 Build 8101 or later.

Who is affected by CVE-2015-5459?