CVE-2014-5445

Description

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.

Related CPE's

azohocorpmanageengine_it36010.3.0*******

azohocorpmanageengine_netflow_analyzer********

References

https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt

ExploitThird Party Advisory

71404

ExploitMailing ListThird Party AdvisoryVDB Entry

https://support.zoho.com/portal/manageengine/helpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-download

Vendor Advisory

http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html

ExploitPatchThird Party AdvisoryVDB EntryVendor Advisory

20141203 [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360

ExploitMailing ListThird Party Advisory

https://github.com/rapid7/metasploit-framework/pull/4282

ExploitThird Party Advisory

netflow-cve20145445-dir-traversal(99045)

Third Party AdvisoryVDB Entry

20141203 Re: [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360

Third Party AdvisoryVDB Entry

20141130 [The ManageOwnage Series, part IX]: 0-day arbitrary file download in NetFlow Analyzer and IT360

Third Party AdvisoryVDB Entry

CvssV3 impact

Could not find any metrics

CvssV2 impact

Version

2.0

VectorString

AV:N/AC:L/Au:N/C:P/I:N/A:N

AccessVector

NETWORK

AccessComplexity

LOW

Authentication

NONE

ConfidentialityImpact

PARTIAL

IntegrityImpact

NONE

AvailabilityImpact

NONE

BaseScore

5

Created by Yello
About Severity.io