CVE-2021-20078

Published: Apr 1, 2021Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.

Affected (71)

Products: Zohocorp: Manageengine Opmanager

Zohocorp

1 product

Manageengine Opmanager

Configuration A

71 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Opmanager	Before 12.5
Zohocorp Manageengine Opmanager	Version 12.5 build125000
Zohocorp Manageengine Opmanager	Version 12.5 build125002
Zohocorp Manageengine Opmanager	Version 12.5 build125100
Zohocorp Manageengine Opmanager	Version 12.5 build125101
Zohocorp Manageengine Opmanager	Version 12.5 build125102
Zohocorp Manageengine Opmanager	Version 12.5 build125108
Zohocorp Manageengine Opmanager	Version 12.5 build125110
Zohocorp Manageengine Opmanager	Version 12.5 build125111
Zohocorp Manageengine Opmanager	Version 12.5 build125112
Zohocorp Manageengine Opmanager	Version 12.5 build125113
Zohocorp Manageengine Opmanager	Version 12.5 build125114
Zohocorp Manageengine Opmanager	Version 12.5 build125116
Zohocorp Manageengine Opmanager	Version 12.5 build125117
Zohocorp Manageengine Opmanager	Version 12.5 build125118
Zohocorp Manageengine Opmanager	Version 12.5 build125120
Zohocorp Manageengine Opmanager	Version 12.5 build125121
Zohocorp Manageengine Opmanager	Version 12.5 build125123
Zohocorp Manageengine Opmanager	Version 12.5 build125124
Zohocorp Manageengine Opmanager	Version 12.5 build125125
Zohocorp Manageengine Opmanager	Version 12.5 build125136
Zohocorp Manageengine Opmanager	Version 12.5 build125137
Zohocorp Manageengine Opmanager	Version 12.5 build125139
Zohocorp Manageengine Opmanager	Version 12.5 build125140
Zohocorp Manageengine Opmanager	Version 12.5 build125143
Zohocorp Manageengine Opmanager	Version 12.5 build125144
Zohocorp Manageengine Opmanager	Version 12.5 build125145
Zohocorp Manageengine Opmanager	Version 12.5 build125156
Zohocorp Manageengine Opmanager	Version 12.5 build125157
Zohocorp Manageengine Opmanager	Version 12.5 build125158
Zohocorp Manageengine Opmanager	Version 12.5 build125159
Zohocorp Manageengine Opmanager	Version 12.5 build125161
Zohocorp Manageengine Opmanager	Version 12.5 build125163
Zohocorp Manageengine Opmanager	Version 12.5 build125174
Zohocorp Manageengine Opmanager	Version 12.5 build125175
Zohocorp Manageengine Opmanager	Version 12.5 build125176
Zohocorp Manageengine Opmanager	Version 12.5 build125177
Zohocorp Manageengine Opmanager	Version 12.5 build125178
Zohocorp Manageengine Opmanager	Version 12.5 build125180
Zohocorp Manageengine Opmanager	Version 12.5 build125181
Zohocorp Manageengine Opmanager	Version 12.5 build125192
Zohocorp Manageengine Opmanager	Version 12.5 build125193
Zohocorp Manageengine Opmanager	Version 12.5 build125194
Zohocorp Manageengine Opmanager	Version 12.5 build125195
Zohocorp Manageengine Opmanager	Version 12.5 build125196
Zohocorp Manageengine Opmanager	Version 12.5 build125197
Zohocorp Manageengine Opmanager	Version 12.5 build125198
Zohocorp Manageengine Opmanager	Version 12.5 build125201
Zohocorp Manageengine Opmanager	Version 12.5 build125204
Zohocorp Manageengine Opmanager	Version 12.5 build125212
Zohocorp Manageengine Opmanager	Version 12.5 build125213
Zohocorp Manageengine Opmanager	Version 12.5 build125214
Zohocorp Manageengine Opmanager	Version 12.5 build125215
Zohocorp Manageengine Opmanager	Version 12.5 build125216
Zohocorp Manageengine Opmanager	Version 12.5 build125228
Zohocorp Manageengine Opmanager	Version 12.5 build125229
Zohocorp Manageengine Opmanager	Version 12.5 build125230
Zohocorp Manageengine Opmanager	Version 12.5 build125231
Zohocorp Manageengine Opmanager	Version 12.5 build125232
Zohocorp Manageengine Opmanager	Version 12.5 build125233
Zohocorp Manageengine Opmanager	Version 12.5 build125312
Zohocorp Manageengine Opmanager	Version 12.5 build125323
Zohocorp Manageengine Opmanager	Version 12.5 build125324
Zohocorp Manageengine Opmanager	Version 12.5 build125326
Zohocorp Manageengine Opmanager	Version 12.5 build125328
Zohocorp Manageengine Opmanager	Version 12.5 build125329
Zohocorp Manageengine Opmanager	Version 12.5 build125340
Zohocorp Manageengine Opmanager	Version 12.5 build125341
Zohocorp Manageengine Opmanager	Version 12.5 build125342
Zohocorp Manageengine Opmanager	Version 12.5 build125343
Zohocorp Manageengine Opmanager	Version 12.5 build125344

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://www.tenable.com/security/research/tra-2021-10

Source: vulnreport@tenable.com

ExploitThird Party Advisory

https://www.tenable.com/security/research/tra-2021-10

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.