CVE-2020-13818

ManageEngine OpManager OpmSkipFilter Directory Traversal Information Disclosure Vulnerability

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.

En Zoho ManageEngine OpManager versiones anteriores a 125144, cuando es usado (cachestart), una comprobación de salto de directorio puede ser omitida

This vulnerability allows remote attackers to disclose sensitive information on affected installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the OpmSkipFilter class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose files in the context of the service account.

*Credits: Yazhi Wang of Trend Micro Security Research

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-06-04 CVE Reserved
2020-06-04 CVE Published
2024-08-04 CVE Updated
2024-08-14 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (2)

URL	Tag	Source
https://www.zerodayinitiative.com/advisories/ZDI-20-691	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.manageengine.com/network-monitoring/help/read-me-complete.html	2021-06-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				< 12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version " < 12.5"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		-		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125000		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125002		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125100		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125101		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125102		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125108		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125110		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125111		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125112		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125113		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125114		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125116		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125117		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125118		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125120		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125121		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125123		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125124		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125125		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125136		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125137		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125139		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125140		Affected
Zohocorp Search vendor "Zohocorp"		Manageengine Opmanager Search vendor "Zohocorp" for product "Manageengine Opmanager"				12.5 Search vendor "Zohocorp" for product "Manageengine Opmanager" and version "12.5"		build125143		Affected