NVD

Id
33656  
Name
CVE-2014-6034  
Description
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute arbitrary WAR files via a .. (dot dot) in the regionID parameter.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2014-12-04  
Modified Date
2014-12-05  
Seq
2014-6034  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
174829 33656 CVE-2014-6034 20140927 [The ManageOwnage Series, part V]: RCE / file upload / arbitrary file deletion in OpManager, Social IT and IT360  View
174830 33656 CVE-2014-6034 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt  View
174831 33656 CVE-2014-6034 https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16893 JVNDB-2014-005768 複数の ZOHO 製品の com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector サーブレットにおけるディレクトリトラバーサルの脆弱性 ZOHO ManageEngine OpManager、Social IT Plus および IT360 の com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector サーブレットには、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2014-6034 73325 CVE-2014-6034 33656 5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005768.html 2014-09-27 2014-12-05 View