CVE-2014-6036

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 36.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-12-04 · updated 2026-06-17
Weakness: CWE-22

Description

Directory traversal vulnerability in the multipartRequest servlet in ZOHO ManageEngine OpManager 11.3 and earlier, Social IT Plus 11.0, and IT360 10.3, 10.4, and earlier allows remote attackers or remote authenticated users to delete arbitrary files via a .. (dot dot) in the fileName parameter.

Affected products

Zohocorp Manageengine It360: through 10.4; 10.3.0
Zohocorp ManageEngine OpManager: through 11.3
Zohocorp Manageengine Social It Plus: 11.0

References

http://seclists.org/fulldisclosure/2014/Sep/110
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix
http://seclists.org/fulldisclosure/2014/Sep/110
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt
https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix

Get alerted when CVE-2014-6036 or the next vulnerability affects your stack