PT-2014-6476 · Zoho · It360+1

Publicado

2014-12-04

·

Atualizado

2019-07-15

·

CVE-2014-5445

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions ManageEngine Netflow Analyzer versions 8.6 through 10.2 IT360 version 10.3
Description The issue allows remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the CSVServlet or CReportPDFServlet servlet. This can lead to information disclosure.
Recommendations For ManageEngine Netflow Analyzer versions 8.6 through 10.2, avoid using the schFilePath parameter in the CSVServlet or CReportPDFServlet servlet until a fix is available. For IT360 version 10.3, restrict access to the CReportPDFServlet servlet to minimize the risk of exploitation. As a temporary workaround, consider disabling the CSVServlet and CReportPDFServlet servlets until a patch is available.

Exploit

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-5445
ZDI-15-138

Produtos afetados

It360
Zoho Manageengine Netflow Analyzer