medium5.0Public exploit code
CVE-2014-6034
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ManageEngine OpManager / Social IT - Arbitrary File Upload (Metasploit)2014-10-02 · remote · java · Verified
- ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities2014-11-09 · webapps · multiple
Impact
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute arbitrary WAR files via a .. (dot dot) in the regionID parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Manageengine Social It Plus | Version 11.0 |
| Zohocorp | Manageengine It360 | through 10.4 |
| Zohocorp | Manageengine Opmanager | Versions 8.8, 9.0, 9.1, 9.2, 9.4, 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2014/Sep/110
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
- https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix
- http://seclists.org/fulldisclosure/2014/Sep/110
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
- https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix