// For flags

CVE-2014-7863

ManageEngine Applications Manager FailOverHelperServlet Information Disclosure Vulnerability

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

4
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.

El servlet FailOverHelperServlet (también se conoce como FailServlet) en ZOHO ManageEngine Applications Manager versiones anteriores a 11.9 build 11912, OpManager versiones 8 hasta 11.5 build 11400 e IT360 versiones 10.5 y anteriores, no restringe el acceso apropiadamente, lo que permite a atacantes remotos y a usuarios autenticados remotos (1) leer archivos arbitrarios por medio del parámetro fileName en una operación copyfile u (2) obtener información confidencial por medio de un listado de directorio en una operación listdirectory en servlet/FailOverHelperServlet.

This vulnerability allows remote attackers to disclose files on vulnerable installations of ManageEngine Applications Manager. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the FailOverHelperServlet servlet. The issue lies in the failure to properly sanitize a filename. A remote attacker can exploit this vulnerability to disclose files from the system.

*Credits: Andrea Micalizzi (rgod)
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2014-10-05 CVE Reserved
  • 2015-02-09 First Exploit
  • 2015-04-29 CVE Published
  • 2024-08-06 CVE Updated
  • 2024-08-21 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Zohocorp
Search vendor "Zohocorp"
 Manageengine Applications Manager
Search vendor "Zohocorp" for product "Manageengine Applications Manager"
 <= 11.9
Search vendor "Zohocorp" for product "Manageengine Applications Manager" and version " <= 11.9"
-
Affected
Zohocorp
Search vendor "Zohocorp"
 Manageengine It360
Search vendor "Zohocorp" for product "Manageengine It360"
 <= 10.5
Search vendor "Zohocorp" for product "Manageengine It360" and version " <= 10.5"
-
Affected
Zohocorp
Search vendor "Zohocorp"
 Manageengine Opmanager
Search vendor "Zohocorp" for product "Manageengine Opmanager"
 >= 8 <= 11.5
Search vendor "Zohocorp" for product "Manageengine Opmanager" and version " >= 8 <= 11.5"
-
Affected