CVE-2019-8925: Zohocorp ManageEngine Netflow Analyzer

Medium severity, CVSS 4.3. EPSS: 11.6% chance of exploitation in the next 30 days.

An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. An Absolute Path Traversal vulnerability in the Administration zone, in /netflow/servlet/CReportPDFServlet (via the parameter schFilePath), allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via any file name, such as a schFilePath=C:\boot.ini value.

Affected products

• Zohocorp ManageEngine Netflow Analyzer: version 7.0.0.2 only

Published 2019-05-17. Last modified 2026-06-17.