Vulnerability Details : CVE-2020-28653

Public exploit exists!
Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.
Published 2021-02-03 16:15:14
Updated 2022-04-18 15:23:31
Source MITRE
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2020-28653

Exploit prediction scoring system (EPSS) score for CVE-2020-28653

EPSS FAQ
82.16%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-28653

  • ManageEngine OpManager SumPDU Java Deserialization
    Disclosure Date: 2021-07-26
    First seen: 2022-12-23
    exploit/multi/http/opmanager_sumpdu_deserialization
    An HTTP endpoint used by the Manage Engine OpManager Smart Update Manager component can be leveraged to deserialize an arbitrary Java object. This can be abused by an unauthenticated remote attacker to execute OS commands in the context of the OpManager application (NT

CVSS scores for CVE-2020-28653

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 NIST
9.8
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 NIST

References for CVE-2020-28653

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close