CVE-2014-7863
- State
- Published
- Severity
- Not scored
- Published
- Feb 8, 2020
- Updated
- Aug 6, 2024
- Reserved
- Oct 5, 2014
Description
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt
- http://www.securityfocus.com/archive/1/archive/1/534575/100/0/threaded
- http://seclists.org/fulldisclosure/2015/Jan/114
- https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100554
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.