Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2014-7863

CWE-200 — Information Exposure4 documents4 sources

Severity

7.5HIGH

EPSS

88.9%

top 0.48%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Zohocorp Manageengine Applications Manager Zohocorp Manageengine It360 Zohocorp Manageengine Opmanager

Timeline

PublishedFeb 8

Latest updateMay 17

Description

The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDzohocorp/manageengine_opmanager8 — 11.5

▶NVDzohocorp/manageengine_applications_manager11.9

▶NVDzohocorp/manageengine_it36010.5

🔴Vulnerability Details

GHSA

GHSA-cc9f-r47w-qj8f: The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11↗2022-05-17

▶

CVEList

CVE-2014-7863: The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11↗2020-02-08

▶

💥Exploits & PoCs

Exploit-DB

ManageEngine OpManager / Applications Manager / IT360 - 'FailOverServlet' Multiple Vulnerabilities↗2015-02-09

▶