Unscored severity · published Dec 4, 2014
CVE-2014-5445
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read…
–
CVSS
98%
EPSS
No
On KEV
Description
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.
Exploitation
Is it being used?
Exploit prediction (EPSS)98.0% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Manageengine It360 · Zohocorp
10.3.0 · source: NVD
MN
Manageengine Netflow Analyzer · Zohocorp
8.6 through 10.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-5445
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-5445
Exploit
http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html
Exploit
http://seclists.org/fulldisclosure/2014/Dec/9
Third Party Advisory
http://www.securityfocus.com/archive/1/534122/100/0/threaded
Third Party Advisory
http://www.securityfocus.com/archive/1/534141/100/0/threaded
Exploit
http://www.securityfocus.com/bid/71404
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/99045
More from Manageengine It360
7.5
CVE-2014-7863
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and…
–
CVE-2014-7866
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or…
–
CVE-2014-3997
SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7…
–
CVE-2014-7868
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated…
–
CVE-2014-7867
SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and…