CVE-2014-7863
CVSS v3
7.5
HIGH
EPSS Score
88.9 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.
Technical details
- Published
- 2020-02-08
- Exploit-DB
- EDB-43894
Frequently asked questions
What is CVE-2014-7863?
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.
Is CVE-2014-7863 actively exploited?
Active exploitation of CVE-2014-7863 has not been confirmed. The EPSS score is 88.9%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2014-7863?
CVE-2014-7863 has a CVSS v3 base score of 7.5 (HIGH severity).
Is CVE-2014-7863 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2014 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).