Add a note about exploitable versions

rapid7 · Sep 16, 2021 · 4bccc05 · 4bccc05
1 parent fd0f565
commit 4bccc05
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/modules/exploits/multi/http/opmanager_sumpdu_deserialization.rb b/modules/exploits/multi/http/opmanager_sumpdu_deserialization.rb
@@ -27,6 +27,10 @@ def initialize(info = {})
           commands in the context of the OpManager application (NT AUTHORITY\SYSTEM on Windows or root on Linux). This
           vulnerability is also present in other products that are built on top of the OpManager application. This
           vulnerability affects OpManager versions 12.1 - 12.5.328.
+
+          Automatic CVE selection only works for newer targets when the build number is present in the logon page. Due
+          to issues with the serialized payload this module is incompatible with versions prior to 12.3.238 despite them
+          technically being vulnerable.
         },
         'Author' => [
           'Johannes Moritz', # Original Vulnerability Research