CVE-2014-7864: SQL Injection

Published Feb 4, 2015

Updated

Multiple SQL injection vulnerabilities in the FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine OpManager 8 through 11.5 build 11400 and IT360 10.5 and earlier allow remote attackers and remote authenticated users to execute arbitrary SQL commands via the (1) customerName or (2) serverRole parameter in a standbyUpdateInCentral operation to servlet/com.adventnet.me.opmanager.servlet.FailOverHelperServlet.

Affected Software

14 affected components

ZohoCorp ManageEngine OpManager=8.8

ZohoCorp ManageEngine OpManager=9.0

ZohoCorp ManageEngine OpManager=9.1

ZohoCorp ManageEngine OpManager=9.2

ZohoCorp ManageEngine OpManager=9.4

ZohoCorp ManageEngine OpManager=10.0

ZohoCorp ManageEngine OpManager=10.1

ZohoCorp ManageEngine OpManager=10.2

ZohoCorp ManageEngine OpManager=11.0

ZohoCorp ManageEngine OpManager=11.1

ZohoCorp ManageEngine OpManager=11.2

ZohoCorp ManageEngine OpManager=11.3

ZohoCorp ManageEngine OpManager=11.4

ZohoCorp ManageEngine OpManager=11.5

Event History

Feb 4, 2015

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-7864?

CVE-2014-7864 is classified as a high severity vulnerability due to its potential for SQL injection attacks.

How do I fix CVE-2014-7864?

To fix CVE-2014-7864, you should update ZOHO ManageEngine OpManager to a version later than 11.5 build 11400.

What are the impacts of CVE-2014-7864?

CVE-2014-7864 can allow remote attackers to execute arbitrary SQL commands, potentially compromising the database.

Which versions of ManageEngine OpManager are affected by CVE-2014-7864?

CVE-2014-7864 affects ManageEngine OpManager versions 8 to 11.5 build 11400 inclusive.

Who can exploit CVE-2014-7864?

Both remote attackers and authenticated users can exploit CVE-2014-7864 to perform SQL injection attacks.