CVE-2014-6034
zohocorp: no CVSS score yet. EPSS 79% chance of exploitation in the next 30 days.
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute arbitrary WAR files via a .. (dot dot) in the regionID parameter.
- EPSS
- 79% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zohocorp:manageengine_it360
- zohocorp:manageengine_opmanager
- zohocorp:manageengine_social_it_plus
References
- http://seclists.org/fulldisclosure/2014/Sep/110
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
- https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix
- http://seclists.org/fulldisclosure/2014/Sep/110
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt