CVE-2014-7863 : The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applica

The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.

Published 2020-02-08 17:15:11

Updated 2020-02-13 16:30:46

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2014-7863

Zohocorp » Manageengine It360
Versions up to, including, (<=) 10.5
cpe:2.3:a:zohocorp:manageengine_it360:*:*:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Opmanager
Versions from including (>=) 8 and up to, including, (<=) 11.5
cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Applications Manager
Versions up to, including, (<=) 11.9
cpe:2.3:a:zohocorp:manageengine_applications_manager:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-7863

EPSS FAQ

97.52%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2014-7863

ManageEngine Multiple Products Arbitrary Directory Listing

Disclosure Date: 2015-01-28

First seen: 2020-04-26

auxiliary/admin/http/manageengine_dir_listing

This module exploits a directory listing information disclosure vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. It makes a recursive listing, so it will list the whole drive if you ask it to list / in Linu

More information
ManageEngine Multiple Products Arbitrary File Download

Disclosure Date: 2015-01-28

First seen: 2020-04-26

auxiliary/admin/http/manageengine_file_download

This module exploits an arbitrary file download vulnerability in the FailOverHelperServlet on ManageEngine OpManager, Applications Manager and IT360. This vulnerability is unauthenticated on OpManager and Applications Manager, but authenticated in IT360. This

More information

CVSS scores for CVE-2014-7863

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2014-7863

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-7863

https://exchange.xforce.ibmcloud.com/vulnerabilities/100554

ManageEngine OpManager, Applications Manager and IT360 file download CVE-2014-7863 Vulnerability Report
Third Party Advisory;VDB Entry
http://seclists.org/fulldisclosure/2015/Jan/114

Full Disclosure: [The ManageOwnage Series, part XII]: Multiple vulnerabilities in FailOverServlet (OpManager, AppManager, IT360)
Exploit

CVEs referencing this url
http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html

ManageEngine File Download / Content Disclosure / SQL Injection ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet

Vulnerabilities in FailOverHelperServlet
Exploit;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2014-7863