Lucene search

MitreCVE-2014-5007

HistoryJan 17, 2020 - 10:15 p.m.

CVE-2014-5007

2020-01-1722:15:12

CWE-22

mitre

web.nvd.nist.gov

132

cve

2014

5007

directory traversal

vulnerability

zoho

manageengine

desktop central

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.029

Percentile

90.9%

JSON

Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a … (dot dot) in the filename parameter.

Affected configurations

Nvd

Node

zohocorpmanageengine_desktop_centralRange7.0–9.0

zohocorpmanageengine_desktop_central_managed_service_providersRange7.0–9.0

VendorProductVersionCPE
zohocorpmanageengine_desktop_central*cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:*:*:*:*
zohocorpmanageengine_desktop_central_managed_service_providers*cpe:2.3:a:zohocorp:manageengine_desktop_central_managed_service_providers:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_desktop_central	*	cpe:2.3:a:zohocorp:manageengine_desktop_central::::::::
zohocorp	manageengine_desktop_central_managed_service_providers	*	cpe:2.3:a:zohocorp:manageengine_desktop_central_managed_service_providers::::::::