CVE-2014-7867

2014-12-0417:59:05

CWE-89

[email protected]

web.nvd.nist.gov

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

Confidence

Low

EPSS

0.823

Percentile

98.4%

JSON

SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allows remote attackers or remote authenticated users to execute arbitrary SQL commands via the probeName parameter.

Affected configurations

Nvd

Node

zohocorpmanageengine_opmanagerMatch11.3

zohocorpmanageengine_opmanagerMatch11.4

Node

zohocorpmanageengine_social_it_plusMatch11.0

Node

zohocorpmanageengine_it360Match10.3.0

zohocorpmanageengine_it360Match10.4

VendorProductVersionCPE
zohocorpmanageengine_opmanager11.3cpe:2.3:a:zohocorp:manageengine_opmanager:11.3:*:*:*:*:*:*:*
zohocorpmanageengine_opmanager11.4cpe:2.3:a:zohocorp:manageengine_opmanager:11.4:*:*:*:*:*:*:*
zohocorpmanageengine_social_it_plus11.0cpe:2.3:a:zohocorp:manageengine_social_it_plus:11.0:*:*:*:*:*:*:*
zohocorpmanageengine_it36010.3.0cpe:2.3:a:zohocorp:manageengine_it360:10.3.0:*:*:*:*:*:*:*
zohocorpmanageengine_it36010.4cpe:2.3:a:zohocorp:manageengine_it360:10.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_opmanager	11.3	cpe:2.3:a:zohocorp:manageengine_opmanager:11.3:::::::*
zohocorp	manageengine_opmanager	11.4	cpe:2.3:a:zohocorp:manageengine_opmanager:11.4:::::::*
zohocorp	manageengine_social_it_plus	11.0	cpe:2.3:a:zohocorp:manageengine_social_it_plus:11.0:::::::*
zohocorp	manageengine_it360	10.3.0	cpe:2.3:a:zohocorp:manageengine_it360:10.3.0:::::::*
zohocorp	manageengine_it360	10.4	cpe:2.3:a:zohocorp:manageengine_it360:10.4:::::::*