File Access Control Flaw in ZOHO ManageEngine Applications Manager and OpManager
CVE-2014-7863

7.5HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine It360
Manageengine Opmanager
Manageengine Applications Manager
Vendor
CVE Published:
8 February 2020

What is CVE-2014-7863?

The FailOverHelperServlet in ZOHO ManageEngine Applications Manager, OpManager, and IT360 is susceptible to improper access restrictions. This flaw permits unauthorized users, including remote attackers, to exploit the fileName parameter in a copyfile operation, allowing them to read arbitrary files. Furthermore, by initiating a listdirectory operation, sensitive information can be retrieved from the directory listing, exposing critical data that should remain protected.

References

http://packetstormsecurity.com/files/130162/ManageEngine-...
x_refsource_MISC
https://raw.githubusercontent.com/pedrib/PoC/master/Manag...
x_refsource_MISC
http://www.securityfocus.com/archive/1/archive/1/534575/1...
x_refsource_MISC

EPSS Score

88% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.