CVE-2021-37415criticalunder attackCWE-306

CVE-2021-37415

Published · Updated

Follow this CVE+ Monitor ManageEngine ServiceDesk Plus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon
Published on NVDSep 1
CISA KEV+91d
Action required by CISAfederal deadline: 2021-12-15

Apply updates per vendor instructions.

In short

Zoho ManageEngine ServiceDesk Plus versions before 11302 have a flaw that allows attackers to access certain REST API functions without logging in, potentially exposing sensitive data or enabling unauthorized actions.

Technical detail

CWE-306 (Missing Authentication Check) allows unauthenticated access to specific REST API endpoints in ServiceDesk Plus versions prior to 11302. An attacker can exploit this by directly calling affected API URLs without credentials, bypassing authentication controls and gaining unauthorized access to sensitive operations.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a