Unscored severity · published Dec 4, 2014
CVE-2014-6036
Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows…
–
CVSS
36.3%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. (dot dot) in the fileName parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)36.3% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Manageengine It360 · Zohocorp
through 10.4; 10.3.0 · source: NVD
MO
Manageengine Opmanager · Zohocorp
through 11.3 · source: NVD
MS
Manageengine Social IT Plus · Zohocorp
11.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-6036
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-6036
Exploit
http://seclists.org/fulldisclosure/2014/Sep/110
Exploit
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
Patch
https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix
More from Manageengine It360
7.5
CVE-2014-7863
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and…
–
CVE-2014-7866
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or…
–
CVE-2014-3997
SQL injection vulnerability in the MetadataServlet servlet in ManageEngine Password Manager Pro (PMP) and Password Manager Pro Managed Service Providers (MSP) edition 5 through 7…
–
CVE-2014-7868
Multiple SQL injection vulnerabilities in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated…
–
CVE-2014-7867
SQL injection vulnerability in the com.manageengine.opmanager.servlet.UpdateProbeUpgradeStatus servlet in ZOHO ManageEngine OpManager 11.3 and 11.4, IT360 10.3 and 10.4, and…