Skip to content
Fencer Intel
medium 5.0

CVE-2014-6034 json

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine Op…

published 2014-12-04 11 y ago modified 2026-06-17 4 mo ago also EUVD-2014-5922

cvss
5.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
79.0%
EPSS 79.0% chance of exploitation in 30 days, percentile 99.5%
public exploits
3
Metasploit, Exploit-DB

Summary

Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute arbitrary WAR files via a .. (dot dot) in the regionID parameter.

Patch / fix

Timeline

  1. First public exploit (Metasploit exploit/multi/http/opmanager_socialit_file_upload)
  2. Published

Exploit prediction

78.95% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/multi/http/opmanager_socialit_file_upload ManageEngine OpManager and Social IT Arbitrary File Upload metasploit exploit, excellent rank, 2014-09-27
  • EDB-43896 ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities webapps, 2014-11-09
  • EDB-34867 ManageEngine OpManager / Social IT - Arbitrary File Upload (Metasploit) remote, 2014-10-02
  • raw.githubusercontent.com https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/fulldisclosure/2014/Sep/110 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.