CVE-2014-6037
HighSummary
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name.
Risk Assessment
Attackers can exploit this vulnerability to execute malicious code on the server, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade to Build 11072 to mitigate this vulnerability and to monitor the system for unauthorized activities.
Other vulnerabilities in ZOHO ManageEngine EventLog Analyzer
Original NVD description (English source)
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name, then accessing the executable via a direct request to the file under the web root. Fixed in Build 11072.