CVE-2014-6034

Published: Dec 4, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute arbitrary WAR files via a .. (dot dot) in the regionID parameter.

Affected (14)

Products: Zohocorp: Manageengine Social It Plus, Manageengine It360, Manageengine Opmanager

Zohocorp

3 products

Manageengine Social It Plus

Manageengine It360

Manageengine Opmanager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Social It Plus	Version 11.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine It360	Up to 10.4

Configuration C

12 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Opmanager	Version 10.0
Zohocorp Manageengine Opmanager	Version 10.1
Zohocorp Manageengine Opmanager	Version 10.2
Zohocorp Manageengine Opmanager	Version 11.0
Zohocorp Manageengine Opmanager	Version 11.1
Zohocorp Manageengine Opmanager	Version 11.2
Zohocorp Manageengine Opmanager	Version 11.3
Zohocorp Manageengine Opmanager	Version 8.8
Zohocorp Manageengine Opmanager	Version 9.0
Zohocorp Manageengine Opmanager	Version 9.1
Zohocorp Manageengine Opmanager	Version 9.2
Zohocorp Manageengine Opmanager	Version 9.4