PT-2014-6476
CVE-2014-5445
·
تاريخ النشر
2014-12-04
·
تاريخ التحديث
2019-07-15
الوصف من
CVSS 2.0
5.0
متوسطةالمقاييسAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions
ManageEngine Netflow Analyzer versions 8.6 through 10.2
IT360 version 10.3
Description
The issue allows remote attackers or remote authenticated users to read arbitrary files via a full pathname in the
schFilePath parameter to the CSVServlet or CReportPDFServlet servlet. This can lead to information disclosure.Recommendations
For ManageEngine Netflow Analyzer versions 8.6 through 10.2, avoid using the
schFilePath parameter in the CSVServlet or CReportPDFServlet servlet until a fix is available.
For IT360 version 10.3, restrict access to the CReportPDFServlet servlet to minimize the risk of exploitation.
As a temporary workaround, consider disabling the CSVServlet and CReportPDFServlet servlets until a patch is available. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾