CVE-2014-8678 Information disclosure in n/a

High 7.8 Published 25 Nov 2014 Updated 6 Aug 2024

Remote attackers can disclose files via a crafted filename in the ConfigSaveServlet, requiring an upgrade to mitigate.

Exploited in the wild: Not known
Login needed: Not stated
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2014-8678?

CVE-2014-8678 is a high-severity vulnerability in n/a, published on 25 Nov 2014. It can be exploited over the network, with no action from the victim.

Official description

The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to "disclose" files via a crafted filename, related to "saveFile."

Weakness: CWE-200

Which versions are affected by CVE-2014-8678?

It affects 1 product.

Products include Manageengine Oputils.

How do I fix CVE-2014-8678?

No fix has been published for CVE-2014-8678 yet. Limit exposure of the affected software until one is available.

Is CVE-2014-8678 being exploited?

There is no known exploitation of CVE-2014-8678 in the wild and no public exploit code.

Sources

Also known as GHSA-c2p2-53fr-grg7.