CVE-2014-5377

CVE-2014-5377 affects ManageEngine DeviceExpert prior to version 5.9 build 5981. An unauthenticated GET request to /ReadUsersFromMasterServlet can disclose user credentials (username and password hashes) from the appliance. Public writeups and modules corroborate this as a credential/disclosure r...