NVD

Id
33658  
Name
CVE-2014-6036  
Description
Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. (dot dot) in the fileName parameter.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-12-04  
Modified Date
2014-12-05  
Seq
2014-6036  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
174835 33658 CVE-2014-6036 20140927 [The ManageOwnage Series, part V]: RCE / file upload / arbitrary file deletion in OpManager, Social IT and IT360  View
174836 33658 CVE-2014-6036 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt  View
174837 33658 CVE-2014-6036 https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16895 JVNDB-2014-005770 複数の ZOHO 製品の multipartRequest サーブレットにおけるディレクトリトラバーサルの脆弱性 ZOHO ManageEngine OpManager、Social IT Plus および IT360 の multipartRequest サーブレットには、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2014-6036 73327 CVE-2014-6036 33658 5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005770.html 2014-09-27 2014-12-05 View