VulnerabilityModified

CVE-2014-9372

Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) before 7103 allows remote attackers to delete arbitrary files via a ..

MEDIUM 6.4EPSS 2.37%

Does this matter?

Lower severity and a low EPSS score (2.37%). Track it; it rarely justifies an emergency change on its own.

Description

Directory traversal vulnerability in the UploadAccountActivities servlet in ManageEngine Password Manager Pro (PMP) before 7103 allows remote attackers to delete arbitrary files via a .. (dot dot) in a filename.

CVSS 2.0: 6.4 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P
EPSS: 2.37% probability · 83th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: manageengine/password manager pro
Source: cve@mitre.org

References

http://www.manageengine.com/products/passwordmanagerpro/release-notes.htmlVendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-14-421/
http://www.manageengine.com/products/passwordmanagerpro/release-notes.htmlVendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-14-421/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.