NVD

Id
33114  
Name
CVE-2014-5445  
Description
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2014-12-04  
Modified Date
2014-12-05  
Seq
2014-5445  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
173599 33114 CVE-2014-5445 http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html  View
173600 33114 CVE-2014-5445 20141203 [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360  View
173601 33114 CVE-2014-5445 20141130 [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360  View
173602 33114 CVE-2014-5445 20141203 Re: [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360  View
173603 33114 CVE-2014-5445 71404  View
173604 33114 CVE-2014-5445 netflow-cve20145445-dir-traversal(99045)  View
173605 33114 CVE-2014-5445 https://github.com/rapid7/metasploit-framework/pull/4282  View
173606 33114 CVE-2014-5445 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt  View
173607 33114 CVE-2014-5445 https://support.zoho.com/portal/manageengine/helpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-download  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16891 JVNDB-2014-005766 ZOHO ManageEngine Netflow Analyzer および IT360 における絶対パストラバーサルの脆弱性 ZOHO ManageEngine Netflow Analyzer および IT360 には、絶対パストラバーサルの脆弱性が存在します。 CVE-2014-5445 72735 CVE-2014-5445 33114 5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005766.html 2014-11-30 2014-12-05 View