Lucene search

[email protected]CVE-2014-7864

HistoryFeb 04, 2015 - 4:59 p.m.

CVE-2014-7864

2015-02-0416:59:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2014-7864

zoho

opmanager

it360

failoverhelperservlet

sql injection

vulnerability

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.9 High

AI Score

Confidence

High

0.903 High

EPSS

Percentile

98.8%

JSON

Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the (1) customerName or (2) serverRole parameter in a standbyUpdateInCentral operation to servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.

Affected configurations

NVD

Node

zohocorpmanageengine_opmanagerMatch8.8

zohocorpmanageengine_opmanagerMatch9.0

zohocorpmanageengine_opmanagerMatch9.1

zohocorpmanageengine_opmanagerMatch9.2

zohocorpmanageengine_opmanagerMatch9.4

zohocorpmanageengine_opmanagerMatch10.0

zohocorpmanageengine_opmanagerMatch10.1

zohocorpmanageengine_opmanagerMatch10.2

zohocorpmanageengine_opmanagerMatch11.0

zohocorpmanageengine_opmanagerMatch11.1

zohocorpmanageengine_opmanagerMatch11.2

zohocorpmanageengine_opmanagerMatch11.3

zohocorpmanageengine_opmanagerMatch11.4

zohocorpmanageengine_opmanagerMatch11.5

CPENameOperatorVersion
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq8.8
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq9.0
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq9.1
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq9.2
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq9.4
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq10.0
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq10.1
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq10.2
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq11.0
zohocorp:manageengine_opmanagerzohocorp manageengine opmanagereq11.1

CPE	Name	Operator	Version
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	8.8
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	9.0
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	9.1
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	9.2
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	9.4
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	10.0
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	10.1
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	10.2
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	11.0
zohocorp:manageengine_opmanager	zohocorp manageengine opmanager	eq	11.1