CVE-2014-6034
Summary
| CVE | CVE-2014-6034 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-12-04 17:59:00 UTC |
| Updated | 2014-12-05 13:45:00 UTC |
| Description | Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute arbitrary WAR files via a .. (dot dot) in the regionID parameter. |
Risk And Classification
Problem Types: CWE-22
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Zohocorp | Manageengine It360 | All | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 10.0 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 10.1 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 10.2 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 11.0 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 11.1 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 11.2 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 11.3 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 8.8 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 9.0 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 9.1 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 9.2 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 9.4 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 10.0 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 10.1 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 10.2 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 11.0 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 11.1 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 11.2 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 11.3 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 8.8 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 9.0 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 9.1 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 9.2 | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 9.4 | All | All | All |
| Application | Zohocorp | Manageengine Social It Plus | 11.0 | All | All | All |
| Application | Zohocorp | Manageengine Social It Plus | 11.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt | MISC | raw.githubusercontent.com | Exploit |
| Full Disclosure: [The ManageOwnage Series, part V]: RCE / file upload / arbitrary file deletion in OpManager, Social IT and IT360 | FULLDISC | seclists.org | Exploit |
| POPUP | CONFIRM | support.zoho.com | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.