Unknown
CVE-2014-7866
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
Unknown
(0 users assessed)
Unknown
(0 users assessed)Unknown
Unknown
Unknown
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. (dot dot) in the (1) fileName parameter to the MigrateLEEData servlet or (2) zipFileName parameter in a downloadFileFromProbe operation to the MigrateCentralData servlet.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
General Information
Vendors
Products
- manageengine it360 10.3.0,
- manageengine it360 10.4,
- manageengine opmanager 10.0,
- manageengine opmanager 10.1,
- manageengine opmanager 10.2,
- manageengine opmanager 11.0,
- manageengine opmanager 11.1,
- manageengine opmanager 11.2,
- manageengine opmanager 11.3,
- manageengine opmanager 11.4,
- manageengine opmanager 8.8,
- manageengine opmanager 9.0,
- manageengine opmanager 9.1,
- manageengine opmanager 9.2,
- manageengine opmanager 9.4,
- manageengine social it plus 11.0
References
Advisory
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Zero-day Exploit
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
