Read the docs
TI-2020-10806 Aliases CVE-2020-13818GHSA-5xqq-qrg2-3jv7

In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.

Priority MEDIUM 60CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

In Zoho ManageEngine OpManager before 125144, when <cachestart> is used, directory traversal validation can be bypassed.

Why it matters now

EPSS 0.37792 98th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 26

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*before 12.5VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:-:*:*:*:*:*:*12.5VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125000:*:*:*:*:*:*12.5 build125000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125002:*:*:*:*:*:*12.5 build125002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125100:*:*:*:*:*:*12.5 build125100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125101:*:*:*:*:*:*12.5 build125101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125102:*:*:*:*:*:*12.5 build125102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125108:*:*:*:*:*:*12.5 build125108VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125110:*:*:*:*:*:*12.5 build125110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125111:*:*:*:*:*:*12.5 build125111VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:* Versions before 12.5 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:-:*:*:*:*:*:* Versions 12.5 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125000:*:*:*:*:*:* Versions 12.5 build125000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125002:*:*:*:*:*:* Versions 12.5 build125002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125100:*:*:*:*:*:* Versions 12.5 build125100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125101:*:*:*:*:*:* Versions 12.5 build125101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125102:*:*:*:*:*:* Versions 12.5 build125102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125108:*:*:*:*:*:* Versions 12.5 build125108 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125110:*:*:*:*:*:* Versions 12.5 build125110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125111:*:*:*:*:*:* Versions 12.5 build125111 Vulnerable ·Zohocorp
Show 16 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125112:*:*:*:*:*:*12.5 build125112VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125113:*:*:*:*:*:*12.5 build125113VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125114:*:*:*:*:*:*12.5 build125114VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125116:*:*:*:*:*:*12.5 build125116VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125117:*:*:*:*:*:*12.5 build125117VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125118:*:*:*:*:*:*12.5 build125118VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125120:*:*:*:*:*:*12.5 build125120VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125121:*:*:*:*:*:*12.5 build125121VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125123:*:*:*:*:*:*12.5 build125123VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125124:*:*:*:*:*:*12.5 build125124VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125125:*:*:*:*:*:*12.5 build125125VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125136:*:*:*:*:*:*12.5 build125136VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125137:*:*:*:*:*:*12.5 build125137VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125139:*:*:*:*:*:*12.5 build125139VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125140:*:*:*:*:*:*12.5 build125140VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125143:*:*:*:*:*:*12.5 build125143VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125112:*:*:*:*:*:* Versions 12.5 build125112 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125113:*:*:*:*:*:* Versions 12.5 build125113 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125114:*:*:*:*:*:* Versions 12.5 build125114 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125116:*:*:*:*:*:* Versions 12.5 build125116 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125117:*:*:*:*:*:* Versions 12.5 build125117 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125118:*:*:*:*:*:* Versions 12.5 build125118 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125120:*:*:*:*:*:* Versions 12.5 build125120 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125121:*:*:*:*:*:* Versions 12.5 build125121 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125123:*:*:*:*:*:* Versions 12.5 build125123 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125124:*:*:*:*:*:* Versions 12.5 build125124 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125125:*:*:*:*:*:* Versions 12.5 build125125 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125136:*:*:*:*:*:* Versions 12.5 build125136 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125137:*:*:*:*:*:* Versions 12.5 build125137 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125139:*:*:*:*:*:* Versions 12.5 build125139 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125140:*:*:*:*:*:* Versions 12.5 build125140 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_opmanager:12.5:build125143:*:*:*:*:*:* Versions 12.5 build125143 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13818
  2. 2026-10-03 Alias added: GHSA-5xqq-qrg2-3jv7

References

Advisory 1

Other 1

  • TI-2022-11994 Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. CVSS 3.1CRITICAL 9.8
  • TI-2021-18117 Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. CVSS 3.1CRITICAL 9.8
  • TI-2020-17379 Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233)… CVSS 3.1CRITICAL 9.8
  • TI-2019-13137 An issue was discovered in Zoho ManageEngine OpManager before 12.4 build 124089. CVSS 3.1CRITICAL 9.8
  • TI-2023-14824 Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote… CVSS 3.1HIGH 8.8
  • TI-2018-12325 Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. CVSS 3.0CRITICAL 9.8
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences