CVE-2014-6037

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name, then accessing the executable via a direct request to the file under the web root. Fixed in Build 11072.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

84.18% chance of exploitation in the next 30 days, 100th percentile

Published

2014-10-26

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/34519

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/eventlog_file_upload.…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/34670
• https://www.exploit-db.com/exploits/34519

References

• CVE Record
• NVD entry

Related

• CVE-2014-6036
• CVE-2014-6038
• CVE-2014-6035
• CVE-2014-6039
• CVE-2014-6034
• CVE-2014-6041