{"id":"CVE-2014-6034","url":"https://www.cyber-defence.io/tools/cve/CVE-2014-6034","generatedAt":"2026-11-05T06:44:08.972Z","title":"Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote…","description":"Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in ZOHO ManageEngine OpManager 8.8 through 11.3, Social IT Plus 11.0, and IT360 10.4 and earlier allows remote attackers or remote authenticated users to write to and execute arbitrary WAR files via a .. (dot dot) in the regionID parameter.","published":"2014-12-04T17:59:03.000Z","lastModified":"2026-06-17T00:12:29.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":5,"severity":"MEDIUM","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N"},"cwe":["CWE-22"],"affected":["zohocorp/manageengine social it plus","zohocorp/manageengine it360","zohocorp/manageengine opmanager"],"epss":{"score":0.78954,"percentile":0.99595,"date":"2026-11-04","history":[]},"kev":{"listed":false},"exploits":{"count":2,"verified":true,"firstPublished":"2014-10-02","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":43896,"kind":"exploit","title":"ManageEngine OpManager / Social IT Plus / IT360 - Multiple Vulnerabilities","url":"https://www.exploit-db.com/exploits/43896","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/43896.txt","file":"exploits/multiple/webapps/43896.txt","published":"2014-11-09","added":"2018-01-25","updated":"2018-01-25","author":"Pedro Ribeiro","type":"webapps","platform":"multiple","port":null,"verified":false,"codes":["CVE-2014-7868","CVE-2014-7866","CVE-2014-6036","CVE-2014-6035","CVE-2014-6034"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/pedrib/PoC/blob/a2842a650de88c582e963493d5e2711aa4a1b747/advisories/ManageEngine/me_opmanager_socialit_it360.txt"},{"edbId":34867,"kind":"exploit","title":"ManageEngine OpManager / Social IT - Arbitrary File Upload (Metasploit)","url":"https://www.exploit-db.com/exploits/34867","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/java/remote/34867.rb","file":"exploits/java/remote/34867.rb","published":"2014-10-02","added":"2014-10-02","updated":"2014-10-02","author":"Pedro Ribeiro","type":"remote","platform":"java","port":80,"verified":true,"codes":["CVE-2014-6034","OSVDB-112276"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 79.0%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://seclists.org/fulldisclosure/2014/Sep/110","tags":["Exploit"],"source":"cve@mitre.org"},{"url":"https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt","tags":["Exploit"],"source":"cve@mitre.org"},{"url":"https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix","tags":["Patch"],"source":"cve@mitre.org"},{"url":"http://seclists.org/fulldisclosure/2014/Sep/110","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt","tags":["Exploit"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.zoho.com/portal/manageengine/helpcenter/articles/servlet-vulnerability-fix","tags":["Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-6034","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}