CVE-2014-100002: ManageEngine SupportCenter Plus path traversal in WorkOrder.do attachment

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote file read with public exploit code and very high EPSS, though the CVSS 2.0 base score is only medium and no KEV listing exists.

What it is

ManageEngine SupportCenter Plus 7.9 before build 7917 has a directory traversal flaw in the attach parameter of WorkOrder.do when adding a file attachment to a new ticket. A remote attacker can supply a ..%2f encoded slash sequence to escape the intended directory and read arbitrary files from the server. Because the exposed component is a pre-authentication web endpoint, the flaw matters to any internet-facing deployment of the affected build.

Impact

An attacker gains read access to arbitrary files on the server, which can expose configuration data, credentials and other sensitive content. The CVSS 2.0 vector shows partial confidentiality impact only, with no integrity or availability effect.

Attack surface

Reached over the network through the WorkOrder.do endpoint's attach parameter in the ticket attachment workflow. The CVSS 2.0 vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

A public Exploit-DB entry (31262) exists, so exploit code is publicly available. The CVE is not listed in CISA KEV, but EPSS is high at roughly 0.60 probability (99th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade ManageEngine SupportCenter Plus to build 7917 or later, which the vendor readme identifies as the fixed release.
• If immediate upgrade is not possible, restrict network access to the SupportCenter Plus web interface to trusted networks or place it behind an authenticating reverse proxy.
• Validate and sanitize the attach parameter server-side, rejecting path traversal sequences such as ..%2f and ..%5c before file access.
• Run the service with least privilege and store attachments outside the web root so traversal cannot reach sensitive files.
• Review server file permissions to limit what the application account can read if traversal is attempted.

Detection

• Search web logs for requests to WorkOrder.do containing ..%2f, ..%5c or other encoded traversal sequences in the attach parameter.
• Alert on attachment requests that reference paths outside the expected attachment directory or include absolute path prefixes.
• Monitor for unusual file reads by the SupportCenter Plus service account, especially of configuration or credential files.
• Correlate repeated WorkOrder.do attachment requests from a single source with other scanning or exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.