ZDI-CAN-11127: ManageEngine OpManager OpmSkipFilter Directory Traversal Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of ManageEngine OpManager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the OpmSkipFilter class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose files in the context of the service account.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ManageEngine OpManager |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of ZDI-CAN-11127?
ZDI-CAN-11127 has a high severity level due to its potential for unauthorized sensitive information disclosure.
How do I fix ZDI-CAN-11127?
To fix ZDI-CAN-11127, ensure that you apply the latest security patches provided by ManageEngine for OpManager.
What types of information are vulnerable in ZDI-CAN-11127?
ZDI-CAN-11127 can lead to the exposure of sensitive information that could be exploited by attackers.
Is authentication required to exploit ZDI-CAN-11127?
No, ZDI-CAN-11127 can be exploited without requiring authentication.
Which software versions are affected by ZDI-CAN-11127?
ZDI-CAN-11127 affects certain installations of ManageEngine OpManager, details of which can be found in the advisory.
- agent/references
- agent/softwarecombine
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-20-691
- alias/ZDI-CAN-11127
- alias/CVE-2020-13818
- agent/software-canonical-lookup
- agent/severity
- agent/title
- agent/type
- agent/event
- agent/description
- agent/tags
- agent/source
- vendor/manageengine
- canonical/manageengine opmanager