medium6.4Public exploit code
CVE-2014-6036
Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities2014-11-09 · webapps · multiple
Impact
Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. (dot dot) in the fileName parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Manageengine Opmanager | through 11.3 |
| Zohocorp | Manageengine It360 | through 10.4 Version 10.3.0 |
| Zohocorp | Manageengine Social It Plus | Version 11.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2014/Sep/110
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
- https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix
- http://seclists.org/fulldisclosure/2014/Sep/110
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
- https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix