CVE-2014-7864

ManageEngine OpManager / Applications Manager / IT360 - 'FailOverServlet' Multiple Vulnerabilities

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the (1) customerName or (2) serverRole parameter in a standbyUpdateInCentral operation to servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.

Múltiples vulnerabilidades de inyección SQL en el servlet FailOverHelperServlet (también conocido como FailServlet) en ZOHO ManageEngine OpManager 8 hasta 11.5 build 11400 y IT360 10.5 y anteriores permiten a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro (1) customerName o (2) serverRole en una operación standbyUpdateInCentral en servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.

*Credits: N/A

CVSS Scores

NISTv2 7.5

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-10-05 CVE Reserved
2015-02-04 CVE Published
2015-02-09 First Exploit
2024-08-06 CVE Updated
2024-09-16 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CAPEC

References (7)

URL	Tag	Source
http://www.securityfocus.com/archive/1/534575/100/0/threaded	Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/100555	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/43894	2015-02-09
http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html	2024-08-06
http://seclists.org/fulldisclosure/2015/Jan/114	2024-08-06
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt	2024-08-06
https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet	2024-08-06

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				8.8 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "8.8"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				9.0 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "9.0"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				9.1 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "9.1"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				9.2 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "9.2"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				9.4 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "9.4"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				10.0 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "10.0"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				10.1 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "10.1"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				10.2 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "10.2"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				11.0 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "11.0"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				11.1 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "11.1"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				11.2 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "11.2"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				11.3 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "11.3"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				11.4 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "11.4"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				11.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "11.5"		-		Affected