Unscored severity · published Mar 29, 2014
CVE-2014-0344
Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the…
–
CVSS
5.8%
EPSS
No
On KEV
Description
Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.8% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Manageengine Opstor · Zohocorp
through 8.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0344
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0344
Third Party Advisory
http://www.kb.cert.org/vuls/id/140886
www.securityfocus.com
http://www.securityfocus.com/bid/66499
More from Manageengine Opstor
–
CVE-2014-2670
Cross-site scripting (XSS) vulnerability in Properties.do in ZOHO ManageEngine OpStor before build 8500 allows remote authenticated users to inject arbitrary web script or HTML…