CVE-2014-5446

Published: Dec 4, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. (dot dot) in the filename parameter.

Affected (14)

Products: Zohocorp: Manageengine It360, Manageengine Netflow Analyzer

2 products

Manageengine It360

Manageengine Netflow Analyzer

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine It360	Version 10.3.0

Configuration B

13 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Netflow Analyzer	Version 10.0 beta
Zohocorp Manageengine Netflow Analyzer	Version 10.2
Zohocorp Manageengine Netflow Analyzer	Version 8.6
Zohocorp Manageengine Netflow Analyzer	Version 9.0
Zohocorp Manageengine Netflow Analyzer	Version 9.1
Zohocorp Manageengine Netflow Analyzer	Version 9.5
Zohocorp Manageengine Netflow Analyzer	Version 9.6
Zohocorp Manageengine Netflow Analyzer	Version 9.7
Zohocorp Manageengine Netflow Analyzer	Version 9.8.5
Zohocorp Manageengine Netflow Analyzer	Version 9.8.6
Zohocorp Manageengine Netflow Analyzer	Version 9.8.7
Zohocorp Manageengine Netflow Analyzer	Version 9.8
Zohocorp Manageengine Netflow Analyzer	Version 9.9

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (16)

http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html

Source: cve@mitre.org

Exploit

http://seclists.org/fulldisclosure/2014/Dec/9

Source: cve@mitre.org

Exploit

http://www.securityfocus.com/archive/1/534122/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/534141/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/71404

Source: cve@mitre.org

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/99046

Source: cve@mitre.org

https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt

Source: cve@mitre.org

Exploit

https://support.zoho.com/portal/manageengine/helpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-download

Source: cve@mitre.org

ExploitPatch

http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://seclists.org/fulldisclosure/2014/Dec/9

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.securityfocus.com/archive/1/534122/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/534141/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/71404

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/99046

Source: af854a3a-2127-422b-91ae-364da2661108

https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://support.zoho.com/portal/manageengine/helpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-download

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

Timeline

No history available yet.