CVE-2014-6036: Path Traversal
First published: Thu Dec 04 2014(Updated: )
Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. (dot dot) in the fileName parameter.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ManageEngine OpManager MSP | <=11.3 | |
| ManageEngine IT360 | <=10.4 | |
| ManageEngine IT360 | =10.3.0 | |
| ManageEngine Social IT Plus | =11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-6036?
CVE-2014-6036 is considered a high severity vulnerability due to its potential for remote file deletion.
How do I fix CVE-2014-6036?
To fix CVE-2014-6036, it is recommended to upgrade to a version of ManageEngine OpManager later than 11.3, IT360 later than 10.4, or Social IT Plus later than 11.0.
What systems are affected by CVE-2014-6036?
CVE-2014-6036 affects ManageEngine OpManager versions up to 11.3, ManageEngine IT360 versions up to 10.4, and ManageEngine Social IT Plus version 11.0.
What type of attack can exploit CVE-2014-6036?
CVE-2014-6036 can be exploited through a directory traversal attack that allows unauthorized file deletion.
Who can exploit CVE-2014-6036?
CVE-2014-6036 can be exploited by remote attackers or remote authenticated users who manipulate the fileName parameter.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/references
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/zohocorp
- canonical/manageengine opmanager msp
- version/manageengine opmanager msp/11.3
- canonical/manageengine it360
- version/manageengine it360/10.4
- version/manageengine it360/10.3.0
- canonical/manageengine social it plus
- version/manageengine social it plus/11.0