CVE-2014-6035

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 28.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-12-04 · updated 2026-06-17
Weakness: CWE-22

Description

Directory traversal vulnerability in the FileCollector servlet in ZOHO ManageEngine OpManager 11.4, 11.3, and earlier allows remote attackers to write and execute arbitrary files via a .. (dot dot) in the FILENAME parameter.

Affected products

Zohocorp ManageEngine OpManager: through 11.3; 11.4

References

http://seclists.org/fulldisclosure/2014/Sep/110
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix
http://seclists.org/fulldisclosure/2014/Sep/110
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix

Get alerted when CVE-2014-6035 or the next vulnerability affects your stack