VULNERABILITY INTELLIGENCE

CVE-2014-6036

CVSS score6.4 MEDIUM
EPSS probability36.27%
CISA KEVNot currently listed
Published2014-12-04
Last modified2026-06-17
CVSS vectorAV:N/AC:L/Au:N/C:N/I:P/A:P

Description

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. (dot dot) in the fileName parameter.

Weakness classification

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references