CVE-2021-20078: Path Traversal
Published Apr 1, 2021
·Updated
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.
Affected Software
71 affected components
ZohoCorp ManageEngine OpManager<12.5
ZohoCorp ManageEngine OpManager=12.5-build125000
ZohoCorp ManageEngine OpManager=12.5-build125002
ZohoCorp ManageEngine OpManager=12.5-build125100
ZohoCorp ManageEngine OpManager=12.5-build125101
ZohoCorp ManageEngine OpManager=12.5-build125102
ZohoCorp ManageEngine OpManager=12.5-build125108
ZohoCorp ManageEngine OpManager=12.5-build125110
ZohoCorp ManageEngine OpManager=12.5-build125111
ZohoCorp ManageEngine OpManager=12.5-build125112
ZohoCorp ManageEngine OpManager=12.5-build125113
ZohoCorp ManageEngine OpManager=12.5-build125114
ZohoCorp ManageEngine OpManager=12.5-build125116
ZohoCorp ManageEngine OpManager=12.5-build125117
ZohoCorp ManageEngine OpManager=12.5-build125118
ZohoCorp ManageEngine OpManager=12.5-build125120
ZohoCorp ManageEngine OpManager=12.5-build125121
ZohoCorp ManageEngine OpManager=12.5-build125123
ZohoCorp ManageEngine OpManager=12.5-build125124
ZohoCorp ManageEngine OpManager=12.5-build125125
ZohoCorp ManageEngine OpManager=12.5-build125136
ZohoCorp ManageEngine OpManager=12.5-build125137
ZohoCorp ManageEngine OpManager=12.5-build125139
ZohoCorp ManageEngine OpManager=12.5-build125140
ZohoCorp ManageEngine OpManager=12.5-build125143
ZohoCorp ManageEngine OpManager=12.5-build125144
ZohoCorp ManageEngine OpManager=12.5-build125145
ZohoCorp ManageEngine OpManager=12.5-build125156
ZohoCorp ManageEngine OpManager=12.5-build125157
ZohoCorp ManageEngine OpManager=12.5-build125158
ZohoCorp ManageEngine OpManager=12.5-build125159
ZohoCorp ManageEngine OpManager=12.5-build125161
ZohoCorp ManageEngine OpManager=12.5-build125163
ZohoCorp ManageEngine OpManager=12.5-build125174
ZohoCorp ManageEngine OpManager=12.5-build125175
ZohoCorp ManageEngine OpManager=12.5-build125176
ZohoCorp ManageEngine OpManager=12.5-build125177
ZohoCorp ManageEngine OpManager=12.5-build125178
ZohoCorp ManageEngine OpManager=12.5-build125180
ZohoCorp ManageEngine OpManager=12.5-build125181
ZohoCorp ManageEngine OpManager=12.5-build125192
ZohoCorp ManageEngine OpManager=12.5-build125193
ZohoCorp ManageEngine OpManager=12.5-build125194
ZohoCorp ManageEngine OpManager=12.5-build125195
ZohoCorp ManageEngine OpManager=12.5-build125196
ZohoCorp ManageEngine OpManager=12.5-build125197
ZohoCorp ManageEngine OpManager=12.5-build125198
ZohoCorp ManageEngine OpManager=12.5-build125201
ZohoCorp ManageEngine OpManager=12.5-build125204
ZohoCorp ManageEngine OpManager=12.5-build125212
ZohoCorp ManageEngine OpManager=12.5-build125213
ZohoCorp ManageEngine OpManager=12.5-build125214
ZohoCorp ManageEngine OpManager=12.5-build125215
ZohoCorp ManageEngine OpManager=12.5-build125216
ZohoCorp ManageEngine OpManager=12.5-build125228
ZohoCorp ManageEngine OpManager=12.5-build125229
ZohoCorp ManageEngine OpManager=12.5-build125230
ZohoCorp ManageEngine OpManager=12.5-build125231
ZohoCorp ManageEngine OpManager=12.5-build125232
ZohoCorp ManageEngine OpManager=12.5-build125233
ZohoCorp ManageEngine OpManager=12.5-build125312
ZohoCorp ManageEngine OpManager=12.5-build125323
ZohoCorp ManageEngine OpManager=12.5-build125324
ZohoCorp ManageEngine OpManager=12.5-build125326
ZohoCorp ManageEngine OpManager=12.5-build125328
ZohoCorp ManageEngine OpManager=12.5-build125329
ZohoCorp ManageEngine OpManager=12.5-build125340
ZohoCorp ManageEngine OpManager=12.5-build125341
ZohoCorp ManageEngine OpManager=12.5-build125342
ZohoCorp ManageEngine OpManager=12.5-build125343
ZohoCorp ManageEngine OpManager=12.5-build125344
Event History
Apr 1, 2021
CVE Published
via MITRE·06:03 PM
Data Sourced
via MITRE·06:03 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-20078?
CVE-2021-20078 is classified as a critical vulnerability due to its potential for causing a remote denial of service.
2
How do I fix CVE-2021-20078?
To fix CVE-2021-20078, update Manage Engine OpManager to the latest build above 125346.
3
What types of attacks can be executed using CVE-2021-20078?
An attacker can exploit CVE-2021-20078 to remotely delete directories on the operating system.
4
Which versions of Manage Engine OpManager are affected by CVE-2021-20078?
CVE-2021-20078 affects all Manage Engine OpManager builds below 125346.
5
Is there any workaround for CVE-2021-20078 if I cannot update immediately?
The recommended action is to update to a secure build, as there are no official workarounds for CVE-2021-20078.