Unrated severityNVD Advisory· Published Feb 8, 2020· Updated Aug 6, 2024
CVE-2014-7863
CVE-2014-7863
Description
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- ZOHO/ManageEngine Applications Managerdescription
- Range: 8 through 11.5 build 11400
- Range: <= 10.5
- Range: < 11.9 build 11912
Patches
Vulnerability mechanics
References
6- packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.htmlmitrex_refsource_MISC
- seclists.org/fulldisclosure/2015/Jan/114mitrex_refsource_MISC
- www.securityfocus.com/archive/1/archive/1/534575/100/0/threadedmitrex_refsource_MISC
- exchange.xforce.ibmcloud.com/vulnerabilities/100554mitrex_refsource_MISC
- raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txtmitrex_refsource_MISC
- support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservletmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.