CVE-2014-6037

N/A Unknown
Published: October 26, 2014 Modified: May 06, 2026
View on NVD

Description

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name, then accessing the executable via a direct request to the file under the web root. Fixed in Build 11072.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://osvdb.org/show/osvdb/110642
Source: cve@mitre.org
http://packetstormsecurity.com/files/128102/ManageEngine-EventLog-Analyzer-9.9-Authorization-Code-Execution.html
Source: cve@mitre.org
Exploit
http://seclists.org/fulldisclosure/2014/Aug/86
Source: cve@mitre.org
Exploit
http://seclists.org/fulldisclosure/2014/Sep/1
Source: cve@mitre.org
http://seclists.org/fulldisclosure/2014/Sep/19
Source: cve@mitre.org
Exploit
http://seclists.org/fulldisclosure/2014/Sep/20
Source: cve@mitre.org
Exploit
http://www.exploit-db.com/exploits/34519
Source: cve@mitre.org
Exploit
http://www.securityfocus.com/bid/69482
Source: cve@mitre.org
Exploit
https://github.com/rapid7/metasploit-framework/pull/3732
Source: cve@mitre.org
Exploit
https://www.mogwaisecurity.de/advisories/MSA-2014-01.txt
Source: cve@mitre.org
Exploit
http://osvdb.org/show/osvdb/110642
Source: af854a3a-2127-422b-91ae-364da2661108
http://packetstormsecurity.com/files/128102/ManageEngine-EventLog-Analyzer-9.9-Authorization-Code-Execution.html
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://seclists.org/fulldisclosure/2014/Aug/86
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://seclists.org/fulldisclosure/2014/Sep/1
Source: af854a3a-2127-422b-91ae-364da2661108
http://seclists.org/fulldisclosure/2014/Sep/19
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://seclists.org/fulldisclosure/2014/Sep/20
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://www.exploit-db.com/exploits/34519
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
http://www.securityfocus.com/bid/69482
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
https://github.com/rapid7/metasploit-framework/pull/3732
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
https://www.mogwaisecurity.de/advisories/MSA-2014-01.txt
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit

20 reference(s) from NVD

Quick Stats

CVSS v3 Score
N/A / 10.0
EPSS (Exploit Probability)
81.7%
99th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-22

Affected Vendors

zohocorp

Related CVEs

CVE-2026-48303 10.0
CVE-2026-48292 7.8
CVE-2026-48291 7.8
CVE-2026-47961 5.5
CVE-2026-47960 7.4