Lucene search

[email protected]CVE-2015-5459

HistoryJul 08, 2015 - 3:59 p.m.

CVE-2015-5459

2015-07-0815:59:12

CWE-89

[email protected]

web.nvd.nist.gov

cve-2015-5459

sql injection

advancesearch.class

adventnetpasstrix.jar

manageengine password manager pro

pmp

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.2 High

AI Score

Confidence

Low

0.008 Low

EPSS

Percentile

82.2%

JSON

SQL injection vulnerability in the AdvanceSearch.class in AdventNetPassTrix.jar in ManageEngine Password Manager Pro (PMP) before 8.1 Build 8101 allows remote authenticated users to execute arbitrary SQL commands via the ANDOR parameter, as demonstrated by a request to STATE_ID/1425543888647/SQLAdvancedALSearchResult.cc.

Affected configurations

NVD

Node

zohocorpmanageengine_password_manager_proRange≤8.1

CPENameOperatorVersion
zohocorp:manageengine_password_manager_prozohocorp manageengine password manager prole8.1

CPE	Name	Operator	Version
zohocorp:manageengine_password_manager_pro	zohocorp manageengine password manager pro	le	8.1

References

packetstormsecurity.com/files/132511/ManageEngine-Password-Manager-Pro-8.1-SQL-Injection.html

seclists.org/fulldisclosure/2015/Jul/19

seclists.org/fulldisclosure/2015/Jun/104

www.securityfocus.com/bid/75692

www.manageengine.com/products/passwordmanagerpro/release-notes.html

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.2 High

AI Score

Confidence

Low

0.008 Low

EPSS

Percentile

82.2%

JSON

Related for CVE-2015-5459

nvd1 cvelist1 prion1