Main Vulnerability Database Vulnerabilities #VU27697

Path traversal in Zoho ManageEngine OpManager - CVE-2020-12116

Published: May 12, 2020

Vulnerability identifier: #VU27697

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12116

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote non-authenticated attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Affected software

Zoho ManageEngine OpManager

How to mitigate CVE-2020-12116

Install update from vendor's website.

Zoho ManageEngine OpManager - addressed in versions 12.4 124196, 12.5 125125

Links to Public Exploits and PoC-codes

Exploit #2642 - CVE-2020-12116 (Proof of concept code to exploit CVE-2020-12116: Unauthenticated arbitrary file read on ManageEngine OpManger.) (May 12, 2020)

External References

https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125125

Related Security Bulletins

Path traversal in Zoho ManageEngine OpManager