CVE-2014-5007
Directory traversal vulnerability in the agentLogUploader servlet in ZOHO ManageEngine Desktop Central (DC) and Desktop Central Managed Service Providers (MSP) edition before 9 build 90055 allows remote attackers to write to and execute arbitrary files as SYSTEM via a .. (dot dot) in the filename parameter.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Modified - cve@mitre.org
- Published
- 2020-01-17
- Last modified
- 2024-08-06
- Weaknesses
- CWE-22
Affected products
- Manageengine Desktop Central (Zohocorp)
- Manageengine Desktop Central Managed Service Providers (Zohocorp)
References
- http://seclists.org/fulldisclosure/2014/Aug/88
- https://www.manageengine.com/products/desktop-central/remote-code-execution.html
