CVE-2014-5445

Name of the Vulnerable Software and Affected Versions ManageEngine Netflow Analyzer versions 8.6 through 10.2 IT360 version 10.3

Description The issue allows remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the CSVServlet or CReportPDFServlet servlet. This can lead to information disclosure.

Recommendations For ManageEngine Netflow Analyzer versions 8.6 through 10.2, avoid using the schFilePath parameter in the CSVServlet or CReportPDFServlet servlet until a fix is available. For IT360 version 10.3, restrict access to the CReportPDFServlet servlet to minimize the risk of exploitation. As a temporary workaround, consider disabling the CSVServlet and CReportPDFServlet servlets until a patch is available.