Published: 26/10/2014 Updated: 26/03/2020

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 760

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Subscribe to Manageengine Eventlog Analyzer

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote malicious users to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name, then accessing the executable via a direct request to the file under the web root. Fixed in Build 11072.

Vulnerable Product	Search on Vulmon	Subscribe to Product
zohocorp manageengine eventlog analyzer 9.0
zohocorp manageengine eventlog analyzer 8.2

## # This module requires Metasploit: http//metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper include Msf::Exploit::EXE def initiali ...

Mogwai Security Advisory MSA-2014-01 ---------------------------------------------------------------------- Title: ManageEngine EventLog Analyzer Multiple Vulnerabilities Product: ManageEngine EventLog Analyzer Affected versions: EventLog Analyzer 99 (Build 9002) on Windows/Linux Impact: critical Remote: ...

CWE-22 http://www.exploit-db.com/exploits/34519 http://seclists.org/fulldisclosure/2014/Sep/19 http://www.securityfocus.com/bid/69482 https://www.mogwaisecurity.de/advisories/MSA-2014-01.txt http://osvdb.org/show/osvdb/110642 http://seclists.org/fulldisclosure/2014/Aug/86 http://packetstormsecurity.com/files/128102/ManageEngine-EventLog-Analyzer-9.9-Authorization-Code-Execution.html http://seclists.org/fulldisclosure/2014/Sep/20 http://seclists.org/fulldisclosure/2014/Sep/1 https://github.com/rapid7/metasploit-framework/pull/3732 https://nvd.nist.gov https://www.exploit-db.com/exploits/34670/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-6037

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect