CVE-2014-7864
Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 22.7%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the (1) customerName or (2) serverRole parameter in a standbyUpdateInCentral operation to servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 22.67% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- zohocorp/manageengine opmanager
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.htmlExploit
- http://seclists.org/fulldisclosure/2015/Jan/114Exploit
- http://www.securityfocus.com/archive/1/534575/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100555
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txtExploit
- https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservletExploit
- http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.htmlExploit
- http://seclists.org/fulldisclosure/2015/Jan/114Exploit
- http://www.securityfocus.com/archive/1/534575/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100555
- https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txtExploit
- https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservletExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.