Vulnerability Description
Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conjunction with a true value of the edit parameter.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | Manageengine Opstor | <= 8.3 |
Related Weaknesses (CWE)
References
- http://www.kb.cert.org/vuls/id/140886Third Party AdvisoryUS Government Resource
- http://www.securityfocus.com/bid/66499
- http://www.kb.cert.org/vuls/id/140886Third Party AdvisoryUS Government Resource
- http://www.securityfocus.com/bid/66499
FAQ
What is CVE-2014-0344?
CVE-2014-0344 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Properties.do in ZOHO ManageEngine OpStor before build 8500 does not properly check privilege levels, which allows remote authenticated users to obtain Admin access by using the name parameter in conj...
How severe is CVE-2014-0344?
CVE-2014-0344 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-0344?
Check the references section above for vendor advisories and patch information. Affected products include: Zohocorp Manageengine Opstor.