Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:DIR:MNGE-ENGINE-FILE-DLD |
|---|---|
Severity |
Minor |
Recommended |
Yes |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
ManageEngine NetFlow Analyzer Arbitrary File Download |
Release Date |
2015/01/21 |
Update Number |
2461 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: ManageEngine NetFlow Analyzer Arbitrary File Download
This signature detects attempts to exploit a known vulnerability against Manage Engine NetFlow Analyzer. A successful exploit can lead to download arbitrary files from arbitrary locations on the server.
Extended Description
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.
Affected Products
- Zohocorp manageengine_it360 10.3.0
- Zohocorp manageengine_netflow_analyzer 10.2
- Zohocorp manageengine_netflow_analyzer 8.6
- Zohocorp manageengine_netflow_analyzer 9.0
- Zohocorp manageengine_netflow_analyzer 9.1
- Zohocorp manageengine_netflow_analyzer 9.5
- Zohocorp manageengine_netflow_analyzer 9.6
- Zohocorp manageengine_netflow_analyzer 9.7
- Zohocorp manageengine_netflow_analyzer 9.8
- Zohocorp manageengine_netflow_analyzer 9.8.5
- Zohocorp manageengine_netflow_analyzer 9.8.6
- Zohocorp manageengine_netflow_analyzer 9.8.7
- Zohocorp manageengine_netflow_analyzer 9.9
References
- BugTraq: 71404
- CVE: CVE-2014-5445