CVE-2014-6036

MEDIUM · 6.4 CVSS Gepubliceerd: 04-12-2014 CWE-22

Beschrijving

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. (dot dot) in the fileName parameter.

Vendors

Zohocorp

Affected products

Manageengine Opmanager Manageengine It360 Manageengine Social It Plus

References

seclists.org
raw.githubusercontent.com
support.zoho.com