CVE-2020-12116

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.manageengine.com/network-monitoring/help/read-me-complete.htmlVendor Advisory
https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125125Vendor Advisory
https://www.manageengine.com/network-monitoring/help/read-me-complete.htmlVendor Advisory
https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125125Vendor Advisory

Timeline

Published: May 7, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-121175.3Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration values via a crafted pa CVE-2020-121188.2The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to com CVE-2020-121198.1Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee (RBF). It increases the user's balance with the value of an unconfirmed tr CVE-2020-12127.8An elevation of privilege vulnerability exists when an OLE Automation component improperly handles memory.To exploit this vulnerability, an CVE-2020-121207.5The Correos Express addon for PrestaShop 1.6 through 1.7 allows remote attackers to obtain sensitive information, such as a service's owner CVE-2020-121227.8In Max Secure Max Spyware Detector 1.0.0.044, the driver file (MaxProc64.sys) allows local users to cause a denial of service (BSOD) or poss CVE-2020-121238.1CSRF vulnerabilities in the /cgi-bin/ directory of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to remotely access router endpoi CVE-2020-121249.8A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an atta CVE-2020-121259.8A remote buffer overflow vulnerability in the /cgi-bin/makeRequest.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker CVE-2020-121269.8Multiple authentication bypass vulnerabilities in the /cgi-bin/ endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allow an attacker to leak CVE-2020-121277.5An information disclosure vulnerability in the /cgi-bin/ExportAllSettings.sh endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an at CVE-2020-121287.5DONG JOO CHO File Transfer iFamily 2.1 allows directory traversal related to the ./etc/ path.