CVE-2014-6036

2014-12-0417:59:00

CWE-22

[email protected]

web.nvd.nist.gov

cve

2014

6036

directory traversal

zoho

manageengine

opmanager

vulnerability

security issue

6.2 Medium

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.942 High

EPSS

Percentile

99.1%

JSON

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a … (dot dot) in the fileName parameter.

CPENameOperatorVersion
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagerle11.3
zohocorp:manageengine_it360zohocorp manageengine it360le10.4
zohocorp:manageengine_it360zohocorp manageengine it360eq10.3.0
zohocorp:manageengine_social_it_pluszohocorp manageengine social it pluseq11.0

CPE	Name	Operator	Version
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	le	11.3
zohocorp:manageengine_it360	zohocorp manageengine it360	le	10.4
zohocorp:manageengine_it360	zohocorp manageengine it360	eq	10.3.0
zohocorp:manageengine_social_it_plus	zohocorp manageengine social it plus	eq	11.0