CVE-2021-20078

CRITICAL

9.1

CVSS Score

Published: April 1, 2021 at 06:03 PM UTC

Updated: June 17, 2026 at 03:33 AM UTC

1 product affected across 1 vendorManageengine Opmanager

Using Manage Engine OpManager by N/A?

Get instant alerts when new vulnerabilities affect Manage Engine OpManager - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.1

Exploit prediction

EPSS 60%

Description

Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Manageengine Opmanager · Zohocorp

95%

v < 12.512.5 build125000 12.5 build125002 12.5 build125100 12.5 build125101 12.5 build125102 12.5 build125108 12.5 build125110 12.5 build125111 12.5 build125112 12.5 build125113 12.5 build125114 12.5 build125116 12.5 build125117 12.5 build125118 12.5 build125120 12.5 build125121 12.5 build125123 12.5 build125124 12.5 build125125 12.5 build125136 12.5 build125137 12.5 build125139 12.5 build125140 12.5 build125143 12.5 build125144 12.5 build125145 12.5 build125156 12.5 build125157 12.5 build125158 12.5 build125159 12.5 build125161 12.5 build125163 12.5 build125174 12.5 build125175 12.5 build125176 12.5 build125177 12.5 build125178 12.5 build125180 12.5 build125181 12.5 build125192 12.5 build125193 12.5 build125194 12.5 build125195 12.5 build125196 12.5 build125197 12.5 build125198 12.5 build125201 12.5 build125204 12.5 build125212 12.5 build125213 12.5 build125214 12.5 build125215 12.5 build125216 12.5 build125228 12.5 build125229 12.5 build125230 12.5 build125231 12.5 build125232 12.5 build125233 12.5 build125312 12.5 build125323 12.5 build125324 12.5 build125326 12.5 build125328 12.5 build125329 12.5 build125340 12.5 build125341 12.5 build125342 12.5 build125343 12.5 build125344 All versions prior to version build 125346

Affected range stops below 12.5, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

x_refsource_MISCExploitThird Party Advisory

Source: [email protected]

https://www.tenable.com/security/research/tra-2021-10

CVSS

9.1CRITICAL[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card