CVE-2014-7863
60Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendepss 83%
de la publicación al arma0 días
Publicada en NVD8 feb
1ª PoC9 feb
metasploit28 ene
probabilidad de explotación
83%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
2 exploit(s) público(s)
The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.
Productos afectados
n/a · n/aPoCs públicas encontradas — 2
exploitdbwww.exploit-db.com/exploits/43894no verificadocve_referencepacketstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.htmlno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.htmlhttp://seclists.org/fulldisclosure/2015/Jan/114https://exchange.xforce.ibmcloud.com/vulnerabilities/100554https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txthttps://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservlethttp://www.securityfocus.com/archive/1/archive/1/534575/100/0/threaded