CVE-2014-5445 Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via....
MediumCVSS 5.0
EPSS 98.0%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Zohocorp manageengine it360 | = 10.3.0 | No fix listed |
| Zohocorp ManageEngine NetFlow Analyzer | >= 8.6, <= 10.2 | No fix listed |
References
- packetstormsecurity.com exploit patch third-party-advisory vdb-entry vendor-advisory
- 20141203 [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360 exploit mailing-list third-party-advisory
- 20141130 [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360 mailing-list third-party-advisory vdb-entry
- 20141203 Re: [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360 mailing-list third-party-advisory vdb-entry
- 71404 exploit mailing-list third-party-advisory vdb-entry
- netflow-cve20145445-dir-traversal(99045) third-party-advisory vdb-entry
- github.com exploit third-party-advisory
- raw.githubusercontent.com exploit third-party-advisory
- support.zoho.com vendor-advisory