Unscored severity · published Dec 4, 2014
CVE-2014-6034
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus…
–
CVSS
79%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute arbitrary WAR files via a .. (dot dot) in the regionID parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)79.0% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Manageengine It360 · Zohocorp
through 10.4 · source: NVD
MO
Manageengine Opmanager · Zohocorp
8.8; 9.0; 9.1; 9.2; 9.4; 10.0; +6 more · source: NVD
MS
Manageengine Social IT Plus · Zohocorp
11.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-6034
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-6034
Exploit
http://seclists.org/fulldisclosure/2014/Sep/110
Exploit
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
Patch
https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix
More from Manageengine It360
7.5
CVE-2014-7863
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and…
–
CVE-2014-7866
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or…
–
CVE-2014-3997
SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7…
–
CVE-2014-7868
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated…
–
CVE-2014-7867
SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and…