$ cve CVE-2014-7863 JSON

CVE-2014-7863 EXPLOIT

7.5

HIGH · CVSS 3.1 · EPSS 83.4% (pctl 100)

Patch early

A public exploit exists.

Description

The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.

Scoring

CVSS	7.5 (HIGH, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS	83.4% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-200
On CISA KEV	no
Public exploit	yes
Published	2020-02-08
Last modified	2026-06-17

Affected (3)

Vendor	Product
zohocorp	manageengine applications manager
zohocorp	manageengine it360
zohocorp	manageengine opmanager

Public exploits

Source	Title	Date
exploit-db	ManageEngine OpManager / Applications Manager / IT360 - 'FailOverServlet' Multiple Vulnerabilities	2015-02-09

References

→ the Explorer · watch your stack · NVD