Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2014-5445

Published: 04/12/2014 Updated: 15/07/2019
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 505
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Subscribe to Manageengine It360

Vulnerability Summary

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 up to and including 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

zohocorp manageengine it360 10.3.0

zohocorp manageengine netflow analyzer

Exploits

Exploit DB: ManageEngine Netflow Analyzer / IT360 - Arbitrary File Download
>> Arbitrary file download in ManageEngine Netflow Analyzer and IT360 >> Discovered by Pedro Ribeiro (pedrib@gmailcom), Agile Information Security ========================================================================== Disclosure: 30/11/2014 / Last updated: 3/12/2014 >> Background on the affected product: "NetFlow Analyzer, a ...
Exploit DB: ManageEngine Netflow Analyzer / IT360 File Download
ManageEngine Netflow Analyzer and IT360 suffer from an arbitrary file download vulnerability ...

References

CWE-22https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txthttp://www.securityfocus.com/bid/71404https://support.zoho.com/portal/manageengine/helpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-downloadhttp://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.htmlhttp://seclists.org/fulldisclosure/2014/Dec/9https://github.com/rapid7/metasploit-framework/pull/4282https://exchange.xforce.ibmcloud.com/vulnerabilities/99045http://www.securityfocus.com/archive/1/534141/100/0/threadedhttp://www.securityfocus.com/archive/1/534122/100/0/threadedhttps://nvd.nist.govhttps://www.exploit-db.com/exploits/43895/
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-38028CVE-2024-32406CVE-2024-25624IMAPCVE-2024-2310CVE-2024-0874CVE-2024-20359XXEremote code execution
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook