Vulnerability Details : CVE-2014-5301

Exploit prediction scoring system (EPSS) score for CVE-2014-5301

Metasploit modules for CVE-2014-5301

• ManageEngine Multiple Products Authenticated File Upload

  Disclosure Date : 2014-12-15

  exploit/multi/http/manageengine_auth_upload

  This module exploits a directory traversal vulnerability in ManageEngine ServiceDesk, AssetExplorer, SupportCenter and IT360 when uploading attachment files. The JSP that accepts the upload does not handle correctly '../' sequences, which can be abused to write to the file system. Authentication is needed to exploit this vulnerability, but this module will attempt to login using the default credentials for the administrator and guest accounts. Alternatively, you can provide a pre-authenticated cookie or a username / password. For IT360 targets, enter the RPORT of the ServiceDesk instance (usually 8400). All versions of ServiceDesk prior v9 build 9031 (including MSP but excluding v4), AssetExplorer, SupportCenter and IT360 (including MSP) are vulnerable. At the time of release of this module, only ServiceDesk v9 has been fixed in build 9031 and above. This module has been tested successfully in Wind

  More information

CVSS scores for CVE-2014-5301

CWE ids for CVE-2014-5301

• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
  Assigned by: [email protected] (Primary)

References for CVE-2014-5301

Products affected by CVE-2014-5301