CVE-2014-5445

Опубликовано: 04 дек. 2014

Источник: nvd

CVSS2: 5

EPSS Критический

Описание

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.

Ссылки

http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html
Exploit
Patch
Third Party Advisory
VDB Entry
Vendor Advisory
http://seclists.org/fulldisclosure/2014/Dec/9
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/archive/1/534122/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/534141/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/71404
Exploit
Mailing List
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/99045
Third Party Advisory
VDB Entry
https://github.com/rapid7/metasploit-framework/pull/4282
Exploit
Third Party Advisory
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt
Exploit
Third Party Advisory
https://support.zoho.com/portal/manageengine/helpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-download
Vendor Advisory
http://packetstormsecurity.com/files/129336/ManageEngine-Netflow-Analyzer-IT360-File-Download.html
Exploit
Patch
Third Party Advisory
VDB Entry
Vendor Advisory
http://seclists.org/fulldisclosure/2014/Dec/9
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/archive/1/534122/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/archive/1/534141/100/0/threaded
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/71404
Exploit
Mailing List
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/99045
Third Party Advisory
VDB Entry
https://github.com/rapid7/metasploit-framework/pull/4282
Exploit
Third Party Advisory
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt
Exploit
Third Party Advisory
https://support.zoho.com/portal/manageengine/helpcenter/articles/cve-2014-5445-cve-2014-5446-fix-for-arbitrary-file-download
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zohocorp:manageengine_it360:10.3.0:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:*:*:*:*:*:*:*:*

Версия от 8.6 (включая) до 10.2 (включая)

EPSS

Процентиль: 100%

0.90975

Критический

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-r7hm-265q-g66c

github

больше 3 лет назад