Detections
Analytics
CVE-2014-5445
medium
Description
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.
References
https://exchange.xforce.ibmcloud.com/vulnerabilities/99045
http://www.securityfocus.com/archive/1/534141/100/0/threaded
http://www.securityfocus.com/archive/1/534122/100/0/threaded
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt
https://github.com/rapid7/metasploit-framework/pull/4282
https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-5332
http://www.securityfocus.com/bid/71404
http://seclists.org/fulldisclosure/2014/Dec/9
http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html