CVE-2014-5446: Zohocorp ManageEngine IT360

Medium severity, CVSS 5.0. EPSS: 54.7% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the DisplayChartPDF servlet in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allows remote attackers and remote authenticated users to read arbitrary files via a .. (dot dot) in the filename parameter.

Affected products

• Zohocorp ManageEngine IT360: version 10.3.0 only
• Zohocorp ManageEngine Netflow Analyzer: version 8.6 only; version 9.0 only; version 9.1 only; version 9.5 only; version 9.6 only; version 9.7 only; …

Published 2014-12-04. Last modified 2026-06-17.