CVE-2014-5445

CVE-2014-5445 describes multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer versions 8.6 through 10.2 and IT360 version 10.3. This flaw allows remote attackers, or remote authenticated users, to read arbitrary files on the affected system by supplying a full pathname in the schFilePath parameter to specific servlets. The vulnerability has a CVSS score of 5.0, indicating a medium severity. It can be exploited remotely with low access complexity and no authentication required, leading to potential information disclosure (confidentiality impact). While not listed on CISA's KEV catalog, exploit code is publicly available, including a Metasploit module and an ExploitDB entry, suggesting a higher likelihood of exploitation. Despite this, there is no recorded community discussion or media coverage for this CVE.