CVE-2021-20078
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service...
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.
- Record
CVE-2021-20078- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 2.0
- 9.4 High
AV:N/AC:L/Au:N/C:N/I:C/A:C - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.
- Record
CVE-2021-20078- Updated
- 2026-11-02
EUVDEUVD-2021-7540 No score
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.
- Record
EUVD-2021-7540- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3499-p3c4-fxgm
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service...
Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. This allows a remote attacker to remotely delete any directory or directories on the OS.
- Record
GHSA-3499-p3c4-fxgm- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-20078 is a critical vulnerability (CVSS 9.1) in Zohocorp Manageengine Opmanager, published April 1, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 59.5%, the 99th percentile. No source names a fixed version.