CVE-2014-100002

CVE-2014-100002 is a directory traversal vulnerability affecting ManageEngine SupportCenter Plus versions prior to 7.9 build 7917. An unauthenticated remote attacker can exploit this flaw by submitting a specially crafted file attachment containing an encoded directory traversal sequence (..%2f) to the WorkOrder.do endpoint, allowing them to read arbitrary files on the system. This vulnerability has a CVSS score of 5.0, indicating a medium severity, with low attack complexity and no authentication required. The primary impact is unauthorized information disclosure (confidentiality). Its EPSS score of 0.770360000 and FAUCET Risk Score of 99/100 suggest a high likelihood of exploitation. Exploit code is publicly available, including a Metasploit module and an ExploitDB entry (EDB-31262). Despite the high exploitability scores and public exploit code, there is no evidence of active exploitation in the wild, and community discussion and media coverage are minimal.