CVE-2014-7863

Katalog CVE

CVSS 7.5 · High EPSS 83,4%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada zohocorp manageengine applications manager, zohocorp manageengine it360 +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.

Rincian

Terbit di NVD

8 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

83,4% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet exploit · advisory vendor
• http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html exploit · advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/archive/1/archive/1/534575/100/0/threaded broken link · advisory pihak ketiga · vdb entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100554 advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2015/Jan/114 exploit
• https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt broken link