CVE-2014-5301: ManageEngine ServiceDesk Plus and related products path traversal

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityHigh CVSS (8.8) and very high EPSS with public exploit code, but exploitation requires valid credentials and the CVE is not in KEV.

What it is

A directory traversal flaw (CWE-22) affects ManageEngine ServiceDesk Plus MSP v5 to v9.0 v9030, AssetExplorer v4 to v6.1, SupportCenter v5 to v7.9, and IT360 v8 to v10.4. An authenticated user can traverse paths to reach files outside the intended directory, and public exploit code exists. The record does not specify the exact vulnerable endpoint or file-write behavior beyond the traversal.

Impact

An attacker with a valid low-privileged account gains read and write access to files outside the intended directory, which can lead to code execution or data disclosure. The CVSS 3.0 vector rates confidentiality, integrity, and availability impact as high.

Attack surface

Reachable over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N). The attacker must already hold a valid account on the affected product.

Exploitation

Public exploit code is referenced in multiple Exploit-tagged advisories and Exploit-DB entry 35845, and EPSS is 0.78378 (99.56th percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Apply the vendor patch for the affected ManageEngine product versions; the record does not list a fixed version, so confirm the current release with ManageEngine.
• Restrict network access to the affected web interfaces to trusted management networks.
• Enforce least privilege and review accounts with access to these products, since exploitation requires authentication.
• Monitor and restrict file upload and file access paths used by the affected applications.
• Retire or isolate end-of-life versions (ServiceDesk Plus MSP v5-v9.0 v9030, AssetExplorer v4-v6.1, SupportCenter v5-v7.9, IT360 v8-v10.4) that cannot be patched.

Detection

• Review web server and application logs for traversal sequences such as ../ or encoded variants in requests to ManageEngine endpoints.
• Alert on file writes or reads outside expected application directories by the ManageEngine service account.
• Monitor for uploads of unexpected file types or shell content to web-accessible paths.
• Correlate authenticated sessions with anomalous file access patterns on hosts running the affected products.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.