CVE-2019-8925: Path Traversal
An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet (via the parameter schFilePath), allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via any file name, such as a schFilePath=C:\boot.ini value.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-8925.
What is the severity rating of CVE-2019-8925?
CVE-2019-8925 has a severity rating of medium.
What is the affected software for CVE-2019-8925?
The affected software for CVE-2019-8925 is Zoho ManageEngine Netflow Analyzer Professional version 7.0.0.2.
What is the CWE ID for CVE-2019-8925?
The CWE ID for CVE-2019-8925 is CWE-22.
How can a remote authenticated user exploit the vulnerability in CVE-2019-8925?
A remote authenticated user can exploit the vulnerability in CVE-2019-8925 by bypassing the SecurityManager restrictions via an Absolute Path Traversal vulnerability in the Administration zone.