CVE-2014-6037

EPSS 84.2%

Vexday Risk Score

60Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 84.2%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Ciclo de vida

31 ago 2014Exploit Metasploit disponible

01 sep 2014PoC pública

26 oct 2014Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name, then accessing the executable via a direct request to the file under the web root. Fixed in Build 11072.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 4

cve_referencepacketstormsecurity.com/files/128102/ManageEngine-EventLog-Analyzer-9.9-Authorization-Code-Execution.htmlno verificado cve_referencewww.exploit-db.com/exploits/34519no verificado exploitdbwww.exploit-db.com/exploits/34519no verificado exploitdbwww.exploit-db.com/exploits/34670no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://osvdb.org/show/osvdb/110642 http://packetstormsecurity.com/files/128102/ManageEngine-EventLog-Analyzer-9.9-Authorization-Code-Execution.html http://seclists.org/fulldisclosure/2014/Aug/86 http://seclists.org/fulldisclosure/2014/Sep/1 http://seclists.org/fulldisclosure/2014/Sep/19 http://seclists.org/fulldisclosure/2014/Sep/20 https://github.com/rapid7/metasploit-framework/pull/3732 https://www.mogwaisecurity.de/advisories/MSA-2014-01.txt http://www.exploit-db.com/exploits/34519 http://www.securityfocus.com/bid/69482