FKIE_CVE-2020-11527
Vulnerability from fkie_nvd - Published: 2020-04-04 17:15 - Updated: 2026-06-17 02:50
Severity
Summary
In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files.
References
Impacted products
{
"affected": [
{
"affectedData": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"source": "cve@mitre.org"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BC6C8B88-B295-48DB-859A-7AF8E9027F62",
"versionEndExcluding": "12.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:-:*:*:*:*:*:*",
"matchCriteriaId": "B666DF1F-0EF8-41F0-9EA0-EB104F87405F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124000:*:*:*:*:*:*",
"matchCriteriaId": "5B7042C9-FD7C-4A83-A755-1429D3CEF91D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124011:*:*:*:*:*:*",
"matchCriteriaId": "86F61865-FB7B-4F12-B8EF-81A1DFB5E7E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124012:*:*:*:*:*:*",
"matchCriteriaId": "5D81E915-18CC-4419-879D-A2D90472F526",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124013:*:*:*:*:*:*",
"matchCriteriaId": "4B9314BA-7CA4-46C2-9ADD-AA15101081FB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124014:*:*:*:*:*:*",
"matchCriteriaId": "4A94FB0E-7487-4E18-A7AD-19E47B03BF1C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124015:*:*:*:*:*:*",
"matchCriteriaId": "D99A8A01-8EDC-4AE6-8ED9-C7AF12DEDA62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124016:*:*:*:*:*:*",
"matchCriteriaId": "44A9BF34-7B3B-4B5F-AEFD-AA7434C6A682",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124022:*:*:*:*:*:*",
"matchCriteriaId": "33068139-B994-4145-B73A-2344A699A0A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124023:*:*:*:*:*:*",
"matchCriteriaId": "B798718E-3E01-4F3D-AD43-9BA7939E2EE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124024:*:*:*:*:*:*",
"matchCriteriaId": "E0C42019-0D5A-4938-87AB-F787C55E9834",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124025:*:*:*:*:*:*",
"matchCriteriaId": "373AA6C3-DA45-4CCD-88EF-859858732FDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124026:*:*:*:*:*:*",
"matchCriteriaId": "13E24695-F223-4F62-B344-4CCB0BBE1050",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124027:*:*:*:*:*:*",
"matchCriteriaId": "C8EDB65B-34E1-4F89-B2E0-CEE13F39DA90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124030:*:*:*:*:*:*",
"matchCriteriaId": "B8F7F90C-57BB-4E2F-BD79-1F56375A4E73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124033:*:*:*:*:*:*",
"matchCriteriaId": "A1343F39-5FAA-4EB7-B95A-5D5133AD5717",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124037:*:*:*:*:*:*",
"matchCriteriaId": "C23F2AB2-714D-4548-B9F9-315CE31CF573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124039:*:*:*:*:*:*",
"matchCriteriaId": "AC8CDE36-EC3C-4F61-872C-8DD33688E0E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124040:*:*:*:*:*:*",
"matchCriteriaId": "D790A131-CA15-42A1-8F35-3DCF27D51060",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124041:*:*:*:*:*:*",
"matchCriteriaId": "C91F973F-3910-41E6-9D2F-3506E8EF5A0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124042:*:*:*:*:*:*",
"matchCriteriaId": "471FFC26-5DE7-42C6-B30B-EF5D1E1A35C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124043:*:*:*:*:*:*",
"matchCriteriaId": "C5407B79-C1DF-481E-83A3-BCE36BEE29E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124051:*:*:*:*:*:*",
"matchCriteriaId": "F09EF7FD-47EB-4989-8805-74EC075F91AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124053:*:*:*:*:*:*",
"matchCriteriaId": "F91FCCC4-C8C0-49B2-86C7-B2896D72F019",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124054:*:*:*:*:*:*",
"matchCriteriaId": "F7679A19-1874-4E97-87A5-60903A549A26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124056:*:*:*:*:*:*",
"matchCriteriaId": "D3B991A7-452F-46C6-AB37-78137A7B27CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124058:*:*:*:*:*:*",
"matchCriteriaId": "66A7CEE9-8647-462A-8F50-9159132E01FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124065:*:*:*:*:*:*",
"matchCriteriaId": "28D368E2-FBB1-4DC2-BDBF-7A4F994A14F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124066:*:*:*:*:*:*",
"matchCriteriaId": "A9F3220A-D461-4412-9F73-B74EB299DBA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124067:*:*:*:*:*:*",
"matchCriteriaId": "7442E3D2-83CC-4F75-89E3-64BAE5937722",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124069:*:*:*:*:*:*",
"matchCriteriaId": "07B87F17-6AF0-4545-9527-154E0C6483C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124070:*:*:*:*:*:*",
"matchCriteriaId": "B565B110-9A53-4BA1-BAB9-C6C16DEECD2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124071:*:*:*:*:*:*",
"matchCriteriaId": "AA46F3B7-0650-4630-9005-1FAC1EC22EE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124074:*:*:*:*:*:*",
"matchCriteriaId": "8706C9CD-0D79-4661-B0C5-AB1813DE1F0F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124075:*:*:*:*:*:*",
"matchCriteriaId": "2BACB527-2F9E-4C6B-8C7B-696EAD5251FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124081:*:*:*:*:*:*",
"matchCriteriaId": "CC9D8F85-EFB8-4D0E-BD8F-6DBE239559F0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124082:*:*:*:*:*:*",
"matchCriteriaId": "0297A0EA-43F2-4AD0-BC73-E6014F1F74BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124085:*:*:*:*:*:*",
"matchCriteriaId": "CA5F1F18-247B-4081-8B53-E34B1512D47F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124086:*:*:*:*:*:*",
"matchCriteriaId": "2B8F85FF-78A7-4BF4-83C2-FC3ABFBC8715",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124087:*:*:*:*:*:*",
"matchCriteriaId": "1C1A1836-D054-4B96-890E-E837050D6202",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124089:*:*:*:*:*:*",
"matchCriteriaId": "25CD5A10-84D3-4EE6-B2A3-2F7B2E7D7CF2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124095:*:*:*:*:*:*",
"matchCriteriaId": "57245302-3114-408E-AE0B-8A2B0E1CC16E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124096:*:*:*:*:*:*",
"matchCriteriaId": "570DF8F0-FEE0-48D2-B4B5-9A42AC710BEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124097:*:*:*:*:*:*",
"matchCriteriaId": "D3A1D662-A800-4CD4-AA9C-A9A5806547AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124098:*:*:*:*:*:*",
"matchCriteriaId": "597EFA52-C830-472F-966A-DE6E0CF5C013",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124099:*:*:*:*:*:*",
"matchCriteriaId": "6CD48702-4DA4-452C-8225-A37A57EF0B10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124100:*:*:*:*:*:*",
"matchCriteriaId": "05ED4A61-EECA-4B98-AACC-0203BE796885",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124101:*:*:*:*:*:*",
"matchCriteriaId": "C6E5D010-9928-4AD6-84DD-8B9DE39B220F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124102:*:*:*:*:*:*",
"matchCriteriaId": "384D799A-4E16-494B-BA57-52245B25E718",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124168:*:*:*:*:*:*",
"matchCriteriaId": "3A48C69B-4AA3-445F-B8B4-608F372712FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124169:*:*:*:*:*:*",
"matchCriteriaId": "84A6CE26-B08A-4EDF-8F00-EEBCDC326F35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124175:*:*:*:*:*:*",
"matchCriteriaId": "162FB7D6-19DF-4701-A969-496166ED1A97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124176:*:*:*:*:*:*",
"matchCriteriaId": "5623BBD0-4FED-4D66-8446-FB67824536F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_opmanager:12.4:build124178:*:*:*:*:*:*",
"matchCriteriaId": "7F459491-376E-46D2-A396-31E76FCD84AD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Zoho ManageEngine OpManager before 12.4.181, an unauthenticated remote attacker can send a specially crafted URI to read arbitrary files."
},
{
"lang": "es",
"value": "En Zoho ManageEngine OpManager versiones anteriores a 12.4.181, un atacante remoto no autenticado puede enviar un URI especialmente dise\u00f1ado para leer archivos arbitrarios."
}
],
"id": "CVE-2020-11527",
"lastModified": "2026-06-17T02:50:20.737",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-04-04T17:15:14.047",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://www.manageengine.com/network-monitoring/help/read-me-complete.html#124181"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.manageengine.com/network-monitoring/help/read-me-complete.html#124181"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…