← Back

CVE-2014-6036

nvd nist
Published: Dec 4, 2014Modified: May 6, 2026

JSON object

Loading...
6.4
Vector
AV:N/AC:L/Au:N/C:N/I:P/A:P
Exploitability: 10.0 / Impact: 4.9
Source: NVD

Description

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. (dot dot) in the fileName parameter.

Affected (4)

Zohocorp
3 products
Manageengine Opmanager
Manageengine It360
Manageengine Social It Plus
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Manageengine Opmanager
Up to 11.3
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Zohocorp
Manageengine It360
Up to 10.4
Manageengine It360
Version 10.3.0
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Manageengine Social It Plus
Version 11.0

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (6)

Source: cve@mitre.org
Exploit
Source: cve@mitre.org
Exploit
Source: cve@mitre.org
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108
Patch

Timeline

No history available yet.