CVE-2014-5446: Path Traversal
Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. (dot dot) in the filename parameter.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5446?
CVE-2014-5446 is considered to have a high severity due to its potential to allow unauthorized file access.
How do I fix CVE-2014-5446?
To fix CVE-2014-5446, update to the latest version of Zoho ManageEngine products, specifically versions that are patched against this vulnerability.
Which versions of ManageEngine are affected by CVE-2014-5446?
CVE-2014-5446 affects ManageEngine NetFlow Analyzer versions 8.6 through 10.2 and IT360 version 10.3.
What types of attacks can CVE-2014-5446 facilitate?
CVE-2014-5446 can facilitate remote attacks that exploit directory traversal vulnerabilities to access sensitive files.
Is authentication required to exploit CVE-2014-5446?
CVE-2014-5446 can be exploited by both remote attackers and authenticated users, making it particularly concerning.