← Back

CVE-2021-28959

nvd nist
Published: Apr 30, 2021Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution.

Affected (5)

Zohocorp
1 product
Manageengine Eventlog Analyzer
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Zohocorp
Manageengine Eventlog Analyzer
Before 12.1.4
Manageengine Eventlog Analyzer
Version 12.1.4
Manageengine Eventlog Analyzer
Version 12.1.4 12141
Manageengine Eventlog Analyzer
Version 12.1.4 12145
Manageengine Eventlog Analyzer
Version 12.1.4 12146

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (4)

Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory

Timeline

No history available yet.