CVE-2014-7866

Zohocorp Manageengine Social IT Plus - Path Traversal

Title source: rule

Description

Multiple directory traversal vulnerabilities in ZOHO ManageEngine OpManager 8 (build 88xx) through 11.4, IT360 10.3 and 10.4, and Social IT Plus 11.0 allow remote attackers or remote authenticated users to write and execute arbitrary files via a .. (dot dot) in the (1) fileName parameter to the MigrateLEEData servlet or (2) zipFileName parameter in a downloadFileFromProbe operation to the MigrateCentralData servlet.

Exploits (2)

exploitdb WRITEUP
webappsjsp
https://www.exploit-db.com/exploits/35209
exploitdb WRITEUP
webappsmultiple
https://www.exploit-db.com/exploits/43896

References (5)

Scores

EPSS 0.8275
EPSS Percentile 99.2%

Classification

CWE
CWE-22
Status draft

Affected Products (16)

zohocorp/manageengine_social_it_plus
zohocorp/manageengine_it360
zohocorp/manageengine_it360
zohocorp/manageengine_opmanager
zohocorp/manageengine_opmanager
zohocorp/manageengine_opmanager
zohocorp/manageengine_opmanager
zohocorp/manageengine_opmanager
zohocorp/manageengine_opmanager
zohocorp/manageengine_opmanager
zohocorp/manageengine_opmanager
zohocorp/manageengine_opmanager
zohocorp/manageengine_opmanager
zohocorp/manageengine_opmanager
zohocorp/manageengine_opmanager
... and 1 more

Timeline

Published Dec 10, 2014
Tracked Since Feb 18, 2026