High severity7.5NVD Advisory· Published Feb 8, 2020· Updated Jun 17, 2026
CVE-2014-7863
CVE-2014-7863
Description
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7- cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:*Range: <=11.9
- cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*Range: >=8,<=11.5
- ZOHO/ManageEngine Applications Managerdescription
- Range: <11.9 build 11912
Patches
Vulnerability mechanics
References
6- packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.htmlnvdExploitThird Party AdvisoryVDB Entry
- seclists.org/fulldisclosure/2015/Jan/114nvdExploit
- support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservletnvdExploitVendor Advisory
- www.securityfocus.com/archive/1/archive/1/534575/100/0/threadednvdBroken LinkThird Party AdvisoryVDB Entry
- exchange.xforce.ibmcloud.com/vulnerabilities/100554nvdThird Party AdvisoryVDB Entry
- raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txtnvdBroken Link
News mentions
0No linked articles in our index yet.