CVE-2014-7863

🗓️ 08 Feb 2020 16:57:37Reported by mitreType

cve🔗 web.nvd.nist.gov👁 152 Views🌐 WEB

ZOHO ManageEngine Applications Manager FailOverHelperServlet Access Restriction Bypas

Reporter	Title	Published	Views	Family All 19
0day.today	ManageEngine Multiple Products Arbitrary File Download Exploit	3 Feb 201500:00	–	zdt
0day.today	ManageEngine Multiple Products Arbitrary Directory Listing Exploit	3 Feb 201500:00	–	zdt
0day.today	ManageEngine OpManager / Applications Manager / IT360 -FailOverServlet Multiple Vulnerability	26 Jan 201800:00	–	zdt
Circl	CVE-2014-7863	29 May 201815:50	–	circl
CNVD	ZOHO ManageEngine Applications Manager FailOverHelperServlet servlet Information Disclosure Vulnerability	30 Apr 201500:00	–	cnvd
Check Point Advisories	ManageEngine Multiple Products FailOverHelperServlet copyfile Information Disclosure (CVE-2014-7863)	2 Mar 201500:00	–	checkpoint_advisories
Cvelist	CVE-2014-7863	8 Feb 202016:57	–	cvelist
Exploit DB	ManageEngine OpManager / Applications Manager / IT360 - 'FailOverServlet' Multiple Vulnerabilities	9 Feb 201500:00	–	exploitdb
exploitpack	ManageEngine OpManager Applications Manager IT360 - FailOverServlet Multiple Vulnerabilities	9 Feb 201500:00	–	exploitpack
Tenable Nessus	ManageEngine Applications Manager FailOverHelperServlet 'fileName' Parameter Arbitrary File Disclosure	8 Jun 201500:00	–	nessus

NVD

Node

zohocorp manageengine_applications_managerRange≤11.9

zohocorp manageengine_it360Range≤10.5

zohocorp manageengine_opmanagerRange8–11.5

Source	Link
raw	www.raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt
seclists	www.seclists.org/fulldisclosure/2015/Jan/114
support	www.support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet
packetstormsecurity	www.packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/100554
securityfocus	www.securityfocus.com/archive/1/archive/1/534575/100/0/threaded

Parameter	Position	Path	Description	CWE
operation	query param	/servlet/FailOverHelperServlet	Arbitrary file download via FailOverHelperServlet (copyfile).	CWE-200
fileName	query param	/servlet/FailOverHelperServlet	Arbitrary file download via FailOverHelperServlet (copyfile).	CWE-200
operation	query param	/servlet/FailOverHelperServlet	Directory listing information disclosure via FailOverHelperServlet (listdirectory).	CWE-200
rootDirectory	query param	/servlet/FailOverHelperServlet	Directory listing information disclosure via FailOverHelperServlet (listdirectory).	CWE-200
operation	query param	/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet	Blind SQL injection via FailOverHelperServlet (standbyUpdateInCentral).	CWE-89, CWE-200
customerName	query param	/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet	Blind SQL injection via FailOverHelperServlet (standbyUpdateInCentral).	CWE-89, CWE-200
serverRole	query param	/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet	Blind SQL injection via FailOverHelperServlet (standbyUpdateInCentral).	CWE-89, CWE-200
operation	query param	/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet	Variant of Blind SQL injection with crafted payload in customerName (SQLi).	CWE-89, CWE-200
customerName	query param	/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet	Variant of Blind SQL injection with crafted payload in customerName (SQLi).	CWE-89, CWE-200
serverRole	query param	/servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet	Variant of Blind SQL injection with crafted payload in customerName (SQLi).	CWE-89, CWE-200

17 Jun 2026 00:15Current

6.9Medium risk

Vulners AI Score6.9

CVSS 25

CVSS 3.17.5

EPSS0.83031

CWE-200