CVE-2014-5446
medium · 5Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. (dot dot) in the filename parameter.
5
CVSS
54.7%
EPSS (exploit prob.)
99th
EPSS percentile
2014-12-04
Published
AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-22
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| zohocorp | manageengine_it360 | 10.3.0 |
| zohocorp | manageengine_netflow_analyzer | 8.6 |
| zohocorp | manageengine_netflow_analyzer | 9.0 |
| zohocorp | manageengine_netflow_analyzer | 9.1 |
| zohocorp | manageengine_netflow_analyzer | 9.5 |
| zohocorp | manageengine_netflow_analyzer | 9.6 |
| zohocorp | manageengine_netflow_analyzer | 9.7 |
| zohocorp | manageengine_netflow_analyzer | 9.8 |
| zohocorp | manageengine_netflow_analyzer | 9.8.5 |
| zohocorp | manageengine_netflow_analyzer | 9.8.6 |
| zohocorp | manageengine_netflow_analyzer | 9.8.7 |
| zohocorp | manageengine_netflow_analyzer | 9.9 |
| zohocorp | manageengine_netflow_analyzer | 10.0 |
| zohocorp | manageengine_netflow_analyzer | 10.2 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html
- http://seclists.org/fulldisclosure/2014/Dec/9
- http://www.securityfocus.com/archive/1/534122/100/0/threaded
- http://www.securityfocus.com/archive/1/534141/100/0/threaded
- http://www.securityfocus.com/bid/71404
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99046
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt
- https://support.zoho.com/portal/manageengine/helpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-download
- http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html
- http://seclists.org/fulldisclosure/2014/Dec/9
- http://www.securityfocus.com/archive/1/534122/100/0/threaded
- http://www.securityfocus.com/archive/1/534141/100/0/threaded
- http://www.securityfocus.com/bid/71404
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99046
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt
- https://support.zoho.com/portal/manageengine/helpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-download
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2014-5446