Vulnerability record · CVE-2014-5445 · published 4 December 2014
CVE-2014-5445: ManageEngine Netflow Analyzer and IT360 path traversal file read
Zohocorp · Manageengine It360
ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 contain absolute path traversal flaws in the CSVServlet and CReportPDFServlet servlets. Supplying a full pathname in the schFilePath parameter lets an attacker read arbitrary files from the server. Because these products handle network and IT monitoring data, exposed file contents can include configuration and credential material.
Description
Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.
AV:N/AC:L/Au:N/C:P/I:N/A:N
Automated analysis
high priorityUnauthenticated network file read with public exploit code and a very high EPSS score, though the CVSS impact is limited to confidentiality.
What it is
ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 contain absolute path traversal flaws in the CSVServlet and CReportPDFServlet servlets. Supplying a full pathname in the schFilePath parameter lets an attacker read arbitrary files from the server. Because these products handle network and IT monitoring data, exposed file contents can include configuration and credential material.
Impact
An attacker can read arbitrary files on the host, exposing configuration files, credentials and other sensitive data. The flaw provides confidentiality loss only; there is no integrity or availability impact per the CVSS vector.
Attack surface
Reachable over the network through HTTP requests to the CSVServlet or CReportPDFServlet with a crafted schFilePath parameter. The CVSS vector indicates no authentication is required, though the description also notes remote authenticated users can exploit it; no user interaction is needed.
Exploitation
Public exploit code exists, including a Metasploit pull request and Packet Storm/Full Disclosure postings, and EPSS is very high (0.98, 99.9th percentile). The CVE is not listed in CISA KEV.
What to do
- Apply the vendor fix referenced in the ZOHO ManageEngine advisory for CVE-2014-5445/CVE-2014-5446.
- Upgrade Netflow Analyzer beyond 10.2 and IT360 beyond 10.3 if supported builds are available.
- Restrict network access to the affected servlets and management interfaces to trusted hosts only.
- Run the application with least privilege so file reads expose minimal sensitive data.
- Monitor for and block traversal sequences such as ../ or absolute paths in schFilePath parameters at the web tier.
Detection
- Search web logs for requests to CSVServlet or CReportPDFServlet containing schFilePath values with absolute paths or ../ sequences.
- Alert on HTTP responses from these servlets returning file content types or unusually large bodies.
- Review host file access logs for reads of sensitive files (for example configuration or credential stores) by the ManageEngine process.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-5445 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-5445), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
