CVE-2014-5005 - Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .

Back Back to CVE browser

HIGH

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .

Published Oct 21, 2014

7.5

HIGH

CVSS 2.0

EPSS 77.85%

Description

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter in an LFU action to statusUpdate.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (5)

http://osvdb.org/show/osvdb/110643
vdb-entryx_refsource_OSVDB
http://seclists.org/fulldisclosure/2014/Aug/88
mailing-listx_refsource_FULLDISCExploit
http://www.exploit-db.com/exploits/34594
exploitx_refsource_EXPLOIT-DB
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc9_file_upload.txt
x_refsource_MISCExploit
https://www.manageengine.com/products/desktop-central/remote-code-execution.html
x_refsource_CONFIRM

Link	Providers	Tags
http://osvdb.org/show/osvdb/110643		vdb-entryx_refsource_OSVDB
http://seclists.org/fulldisclosure/2014/Aug/88		mailing-listx_refsource_FULLDISCExploit
http://www.exploit-db.com/exploits/34594		exploitx_refsource_EXPLOIT-DB
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc9_file_upload.txt		x_refsource_MISCExploit
https://www.manageengine.com/products/desktop-central/remote-code-execution.html		x_refsource_CONFIRM

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 21, 2014

Updated Aug 6, 2024

Reserved Jul 18, 2014

Link CVE-2014-5005

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2014-5005

Red Hat

Severity n/a

Public date n/a

Links CVE-2014-5005