Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-7863

The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.

Published

2020-02-08T17:15:10.980

Last Modified

2024-11-21T02:18:09.847

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-200

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	zohocorp	manageengine_applications_manager	≤ 11.9	Yes
Application	zohocorp	manageengine_it360	≤ 10.5	Yes
Application	zohocorp	manageengine_opmanager	≤ 11.5	Yes

References

http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry ([email protected])
http://seclists.org/fulldisclosure/2015/Jan/114 Exploit ([email protected])
http://www.securityfocus.com/archive/1/archive/1/534575/100/0/threaded Broken Link, Third Party Advisory, VDB Entry ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/100554 Third Party Advisory, VDB Entry ([email protected])
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt Broken Link ([email protected])
https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet Exploit, Vendor Advisory ([email protected])
http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://seclists.org/fulldisclosure/2015/Jan/114 Exploit (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/archive/1/534575/100/0/threaded Broken Link, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/100554 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt Broken Link (af854a3a-2127-422b-91ae-364da2661108)
https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet Exploit, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)