CVE-2014-7863

The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users to (1) read arbitrary files via the fileName parameter in a copyfile operation or (2) obtain sensitive information via a directory listing in a listdirectory operation to servlet/FailOverHelperServlet.

• CWE-200

• http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Jan/114Exploit
• http://www.securityfocus.com/archive/1/archive/1/534575/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100554Third Party Advisory, VDB Entry
• https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txtBroken Link
• https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservletExploit, Vendor Advisory
• http://packetstormsecurity.com/files/130162/ManageEngine-File-Download-Content-Disclosure-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Jan/114Exploit
• http://www.securityfocus.com/archive/1/archive/1/534575/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100554Third Party Advisory, VDB Entry
• https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txtBroken Link
• https://support.zoho.com/portal/manageengine/helpcenter/articles/vulnerabilities-in-failoverhelperservletExploit, Vendor Advisory

Published

Feb 8, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-7857D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.0…
• CVE-2014-7858The check_login function in D-Link DNR-326 before 2.10 build…
• CVE-2014-7859Stack-based buffer overflow in login_mgr.cgi in D-Link firmw…
• CVE-2014-7860The web/web_file/fb_publish.php script in D-Link DNS-320L be…
• CVE-2014-7861The IOHIDSecurePromptClient function in Apple OS X does not …
• CVE-2014-7862The DCPluginServelet servlet in ManageEngine Desktop Central…
• CVE-2014-7864Multiple SQL injection vulnerabilities in the FailOverHelper…
• CVE-2014-7865Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-7866Multiple directory traversal vulnerabilities in ZOHO ManageE…
• CVE-2014-7867SQL injection vulnerability in the com.manageengine.opmanage…
• CVE-2014-7868Multiple SQL injection vulnerabilities in ZOHO ManageEngine …
• CVE-2014-7869Cross-site scripting (XSS) vulnerability in the configuratio…