CVEvulnerability

CVE-2014-5446

5.0 MEDIUM Published 2014-12-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-12-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-22

Description

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. (dot dot) in the filename parameter.

Affected configurations

• zohocorp manageengine it360 10.3.0 • zohocorp manageengine netflow analyzer 8.6 • zohocorp manageengine netflow analyzer 9.0 • zohocorp manageengine netflow analyzer 9.1 • zohocorp manageengine netflow analyzer 9.5 • zohocorp manageengine netflow analyzer 9.6 • zohocorp manageengine netflow analyzer 9.7 • zohocorp manageengine netflow analyzer 9.8 • zohocorp manageengine netflow analyzer 9.8.5 • zohocorp manageengine netflow analyzer 9.8.6 • zohocorp manageengine netflow analyzer 9.8.7 • zohocorp manageengine netflow analyzer 9.9 • zohocorp manageengine netflow analyzer 10.0 • zohocorp manageengine netflow analyzer 10.2

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References