CVE-2014-6036: Path Traversal
Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. (dot dot) in the fileName parameter.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-6036?
CVE-2014-6036 is considered a high severity vulnerability due to its potential for remote file deletion.
How do I fix CVE-2014-6036?
To fix CVE-2014-6036, it is recommended to upgrade to a version of ManageEngine OpManager later than 11.3, IT360 later than 10.4, or Social IT Plus later than 11.0.
What systems are affected by CVE-2014-6036?
CVE-2014-6036 affects ManageEngine OpManager versions up to 11.3, ManageEngine IT360 versions up to 10.4, and ManageEngine Social IT Plus version 11.0.
What type of attack can exploit CVE-2014-6036?
CVE-2014-6036 can be exploited through a directory traversal attack that allows unauthorized file deletion.
Who can exploit CVE-2014-6036?
CVE-2014-6036 can be exploited by remote attackers or remote authenticated users who manipulate the fileName parameter.