← Back

CVE-2020-13818

nvd nist
Published: Jun 4, 2020Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.

Affected (26)

Zohocorp
1 product
Manageengine Opmanager
Configuration A
26 vulnerable
Vulnerable SoftwareAffected Versions
Zohocorp
Manageengine Opmanager
Before 12.5
Manageengine Opmanager
Version 12.5
Manageengine Opmanager
Version 12.5 build125000
Manageengine Opmanager
Version 12.5 build125002
Manageengine Opmanager
Version 12.5 build125100
Manageengine Opmanager
Version 12.5 build125101
Manageengine Opmanager
Version 12.5 build125102
Manageengine Opmanager
Version 12.5 build125108
Manageengine Opmanager
Version 12.5 build125110
Manageengine Opmanager
Version 12.5 build125111
Manageengine Opmanager
Version 12.5 build125112
Manageengine Opmanager
Version 12.5 build125113
Manageengine Opmanager
Version 12.5 build125114
Manageengine Opmanager
Version 12.5 build125116
Manageengine Opmanager
Version 12.5 build125117
Manageengine Opmanager
Version 12.5 build125118
Manageengine Opmanager
Version 12.5 build125120
Manageengine Opmanager
Version 12.5 build125121
Manageengine Opmanager
Version 12.5 build125123
Manageengine Opmanager
Version 12.5 build125124
Manageengine Opmanager
Version 12.5 build125125
Manageengine Opmanager
Version 12.5 build125136
Manageengine Opmanager
Version 12.5 build125137
Manageengine Opmanager
Version 12.5 build125139
Manageengine Opmanager
Version 12.5 build125140
Manageengine Opmanager
Version 12.5 build125143

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (4)

Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.