CVE-2014-5445: Zohocorp ManageEngine IT360

Medium severity, CVSS 5.0. EPSS: 98% chance of exploitation in the next 30 days.

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.

Affected products

• Zohocorp ManageEngine IT360: version 10.3.0 only
• Zohocorp ManageEngine Netflow Analyzer: from 8.6, up to and including 10.2

Published 2014-12-04. Last modified 2026-06-17.