The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to “disclose” files via a crafted filename, related to “saveFile.”
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8678
Reference (s):
- http://www.zerodayinitiative.com/advisories/ZDI-14-386/