CVE-2020-11527 (GCVE-0-2020-11527)

Vulnerability from cvelistv5 – Published: 2020-04-04 16:26 – Updated: 2024-08-04 11:35
VLAI
Summary
In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:35:12.797Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.manageengine.com/network-monitoring/help/read-me-complete.html#124181"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-04T16:26:25.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.manageengine.com/network-monitoring/help/read-me-complete.html#124181"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-11527",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.manageengine.com/network-monitoring/help/read-me-complete.html#124181",
              "refsource": "MISC",
              "url": "https://www.manageengine.com/network-monitoring/help/read-me-complete.html#124181"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-11527",
    "datePublished": "2020-04-04T16:26:25.000Z",
    "dateReserved": "2020-04-04T00:00:00.000Z",
    "dateUpdated": "2024-08-04T11:35:12.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-11527",
      "date": "2026-09-23",
      "epss": "0.09476",
      "percentile": "0.95213"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BC6C8B88-B295-48DB-859A-7AF8E9027F62",
                    "versionEndExcluding": "12.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:-:*:*:*:*:*:*",
                    "matchCriteriaId": "B666DF1F-0EF8-41F0-9EA0-EB104F87405F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124000:*:*:*:*:*:*",
                    "matchCriteriaId": "5B7042C9-FD7C-4A83-A755-1429D3CEF91D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124011:*:*:*:*:*:*",
                    "matchCriteriaId": "86F61865-FB7B-4F12-B8EF-81A1DFB5E7E9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124012:*:*:*:*:*:*",
                    "matchCriteriaId": "5D81E915-18CC-4419-879D-A2D90472F526",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124013:*:*:*:*:*:*",
                    "matchCriteriaId": "4B9314BA-7CA4-46C2-9ADD-AA15101081FB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124014:*:*:*:*:*:*",
                    "matchCriteriaId": "4A94FB0E-7487-4E18-A7AD-19E47B03BF1C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124015:*:*:*:*:*:*",
                    "matchCriteriaId": "D99A8A01-8EDC-4AE6-8ED9-C7AF12DEDA62",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124016:*:*:*:*:*:*",
                    "matchCriteriaId": "44A9BF34-7B3B-4B5F-AEFD-AA7434C6A682",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124022:*:*:*:*:*:*",
                    "matchCriteriaId": "33068139-B994-4145-B73A-2344A699A0A0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124023:*:*:*:*:*:*",
                    "matchCriteriaId": "B798718E-3E01-4F3D-AD43-9BA7939E2EE0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124024:*:*:*:*:*:*",
                    "matchCriteriaId": "E0C42019-0D5A-4938-87AB-F787C55E9834",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124025:*:*:*:*:*:*",
                    "matchCriteriaId": "373AA6C3-DA45-4CCD-88EF-859858732FDB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124026:*:*:*:*:*:*",
                    "matchCriteriaId": "13E24695-F223-4F62-B344-4CCB0BBE1050",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124027:*:*:*:*:*:*",
                    "matchCriteriaId": "C8EDB65B-34E1-4F89-B2E0-CEE13F39DA90",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124030:*:*:*:*:*:*",
                    "matchCriteriaId": "B8F7F90C-57BB-4E2F-BD79-1F56375A4E73",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124033:*:*:*:*:*:*",
                    "matchCriteriaId": "A1343F39-5FAA-4EB7-B95A-5D5133AD5717",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124037:*:*:*:*:*:*",
                    "matchCriteriaId": "C23F2AB2-714D-4548-B9F9-315CE31CF573",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124039:*:*:*:*:*:*",
                    "matchCriteriaId": "AC8CDE36-EC3C-4F61-872C-8DD33688E0E3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124040:*:*:*:*:*:*",
                    "matchCriteriaId": "D790A131-CA15-42A1-8F35-3DCF27D51060",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124041:*:*:*:*:*:*",
                    "matchCriteriaId": "C91F973F-3910-41E6-9D2F-3506E8EF5A0A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124042:*:*:*:*:*:*",
                    "matchCriteriaId": "471FFC26-5DE7-42C6-B30B-EF5D1E1A35C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124043:*:*:*:*:*:*",
                    "matchCriteriaId": "C5407B79-C1DF-481E-83A3-BCE36BEE29E3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124051:*:*:*:*:*:*",
                    "matchCriteriaId": "F09EF7FD-47EB-4989-8805-74EC075F91AD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124053:*:*:*:*:*:*",
                    "matchCriteriaId": "F91FCCC4-C8C0-49B2-86C7-B2896D72F019",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124054:*:*:*:*:*:*",
                    "matchCriteriaId": "F7679A19-1874-4E97-87A5-60903A549A26",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124056:*:*:*:*:*:*",
                    "matchCriteriaId": "D3B991A7-452F-46C6-AB37-78137A7B27CA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124058:*:*:*:*:*:*",
                    "matchCriteriaId": "66A7CEE9-8647-462A-8F50-9159132E01FC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124065:*:*:*:*:*:*",
                    "matchCriteriaId": "28D368E2-FBB1-4DC2-BDBF-7A4F994A14F8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124066:*:*:*:*:*:*",
                    "matchCriteriaId": "A9F3220A-D461-4412-9F73-B74EB299DBA1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124067:*:*:*:*:*:*",
                    "matchCriteriaId": "7442E3D2-83CC-4F75-89E3-64BAE5937722",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124069:*:*:*:*:*:*",
                    "matchCriteriaId": "07B87F17-6AF0-4545-9527-154E0C6483C7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124070:*:*:*:*:*:*",
                    "matchCriteriaId": "B565B110-9A53-4BA1-BAB9-C6C16DEECD2F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124071:*:*:*:*:*:*",
                    "matchCriteriaId": "AA46F3B7-0650-4630-9005-1FAC1EC22EE0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124074:*:*:*:*:*:*",
                    "matchCriteriaId": "8706C9CD-0D79-4661-B0C5-AB1813DE1F0F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124075:*:*:*:*:*:*",
                    "matchCriteriaId": "2BACB527-2F9E-4C6B-8C7B-696EAD5251FC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124081:*:*:*:*:*:*",
                    "matchCriteriaId": "CC9D8F85-EFB8-4D0E-BD8F-6DBE239559F0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124082:*:*:*:*:*:*",
                    "matchCriteriaId": "0297A0EA-43F2-4AD0-BC73-E6014F1F74BD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124085:*:*:*:*:*:*",
                    "matchCriteriaId": "CA5F1F18-247B-4081-8B53-E34B1512D47F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124086:*:*:*:*:*:*",
                    "matchCriteriaId": "2B8F85FF-78A7-4BF4-83C2-FC3ABFBC8715",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124087:*:*:*:*:*:*",
                    "matchCriteriaId": "1C1A1836-D054-4B96-890E-E837050D6202",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124089:*:*:*:*:*:*",
                    "matchCriteriaId": "25CD5A10-84D3-4EE6-B2A3-2F7B2E7D7CF2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124095:*:*:*:*:*:*",
                    "matchCriteriaId": "57245302-3114-408E-AE0B-8A2B0E1CC16E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124096:*:*:*:*:*:*",
                    "matchCriteriaId": "570DF8F0-FEE0-48D2-B4B5-9A42AC710BEB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124097:*:*:*:*:*:*",
                    "matchCriteriaId": "D3A1D662-A800-4CD4-AA9C-A9A5806547AF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124098:*:*:*:*:*:*",
                    "matchCriteriaId": "597EFA52-C830-472F-966A-DE6E0CF5C013",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124099:*:*:*:*:*:*",
                    "matchCriteriaId": "6CD48702-4DA4-452C-8225-A37A57EF0B10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124100:*:*:*:*:*:*",
                    "matchCriteriaId": "05ED4A61-EECA-4B98-AACC-0203BE796885",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124101:*:*:*:*:*:*",
                    "matchCriteriaId": "C6E5D010-9928-4AD6-84DD-8B9DE39B220F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124102:*:*:*:*:*:*",
                    "matchCriteriaId": "384D799A-4E16-494B-BA57-52245B25E718",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124168:*:*:*:*:*:*",
                    "matchCriteriaId": "3A48C69B-4AA3-445F-B8B4-608F372712FC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124169:*:*:*:*:*:*",
                    "matchCriteriaId": "84A6CE26-B08A-4EDF-8F00-EEBCDC326F35",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124175:*:*:*:*:*:*",
                    "matchCriteriaId": "162FB7D6-19DF-4701-A969-496166ED1A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124176:*:*:*:*:*:*",
                    "matchCriteriaId": "5623BBD0-4FED-4D66-8446-FB67824536F7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124178:*:*:*:*:*:*",
                    "matchCriteriaId": "7F459491-376E-46D2-A396-31E76FCD84AD",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files."
          },
          {
            "lang": "es",
            "value": "En Zoho ManageEngine OpManager versiones anteriores a 12.4.181, un atacante remoto no autenticado puede enviar un URI especialmente dise\u00f1ado para leer archivos arbitrarios."
          }
        ],
        "id": "CVE-2020-11527",
        "lastModified": "2024-11-21T04:58:04.810",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 5.0,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2020-04-04T17:15:14.047",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.manageengine.com/network-monitoring/help/read-me-complete.html#124181"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.manageengine.com/network-monitoring/help/read-me-complete.html#124181"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.