Sploitus

CVE-2014-6037

9 known exploits for CVE-2014-6037

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name, then accessing the executable via a direct request to the file under the web root. Fixed in Build 11072.

Affected products
Zoho Manageengine Eventlog Analyzer
Zohocorp Manageengine Eventlog Analyzer
= 8.2, 9.0
Fix
Available
CVSS 2.0
7.5 HIGH
EPSS
84.2% (100th percentile)
Weakness
CWE-22
NVD status
Modified
Published
2014-10-26
CVE-2014-6037 at NVD
Authoritative description, scoring and affected products

9 known exploits for CVE-2014-6037

Proof-of-concept code and exploit modules indexed by Sploitus

ManageEngine Eventlog Analyzer Arbitrary File Upload
2014-09-18 RootSEEBUGRuby
ManageEngine Eventlog Analyzer - Arbitrary File Upload (Metasploit)
2014-09-15 MetasploitEXPLOITDBRuby
ManageEngine Eventlog Analyzer Arbitrary File Upload Exploit
2014-09-12 metasploitZDTRuby
ManageEngine Eventlog Analyzer Arbitrary File Upload
2014-09-12 h0ng10PACKETSTORMRuby
ManageEngine EventLog Analyzer 9.9 File Upload
2014-09-01 Dsquare SecurityD2
ManageEngine Eventlog Analyzer Arbitrary File Upload
2014-09-01 h0ng10, Pedro Ribeiro <pedrib@gmail.com>METASPLOITRuby
ManageEngine EventLog Analyzer Multiple Vulnerabilities
2014-09-01 Hans-Martin MuenchZDT
ManageEngine EventLog Analyzer - Multiple Vulnerabilities (1)
2014-09-01 Hans-Martin MuenchEXPLOITDB
ManageEngine EventLog Analyzer 9.9 Authorization / Code Execution
2014-09-01 Hans-Martin MuenchPACKETSTORM