CVE-2014-6037

2014-10-2619:55:04

CWE-22

mitre

web.nvd.nist.gov

cve-2014-6037

zoho manageengine

eventlog analyzer

vulnerability

code execution

zip file

fix

build 11072

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.6

Confidence

Low

EPSS

0.967

Percentile

99.7%

JSON

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with … (dot dot) sequences in its name, then accessing the executable via a direct request to the file under the web root. Fixed in Build 11072.

Affected configurations

Nvd

Node

zohocorpmanageengine_eventlog_analyzerMatch8.28020

zohocorpmanageengine_eventlog_analyzerMatch9.09002

VendorProductVersionCPE
zohocorpmanageengine_eventlog_analyzer8.2cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:8.2:8020:*:*:*:*:*:*
zohocorpmanageengine_eventlog_analyzer9.0cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:9.0:9002:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_eventlog_analyzer	8.2	cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:8.2:8020::::::
zohocorp	manageengine_eventlog_analyzer	9.0	cpe:2.3:a:zohocorp:manageengine_eventlog_analyzer:9.0:9002::::::