CVE-2014-7863

EPSS 83.4%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 83.4%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

28 Jan 2015Metasploit module available

09 Feb 2015Public PoC

08 Feb 2020Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.htmlunverified exploitdbwww.exploit-db.com/exploits/43894unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.html http://seclists.org/fulldisclosure/2015/Jan/114 https://exchange.xforce.ibmcloud.com/vulnerabilities/100554 https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlet http://www.securityfocus.com/archive/1/archive/1/534575/100/0/threaded