CVE-2021-44077criticalunder attackCWE-306

CVE-2021-44077

Published · Updated

Follow this CVE+ Monitor ManageEngine ServiceDesk Plus / SupportCenter Plus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 94%
from disclosure to weapon9 days
Published on NVDNov 29
1st PoC+9d
metasploitSep 16
CISA KEV+2d
Action required by CISAfederal deadline: 2021-12-15

Apply updates per vendor instructions.

In short

Zoho ManageEngine ServiceDesk Plus and related products allow attackers to run malicious code on the server without needing to log in. This happens through a flaw in how the application handles REST API requests, putting all data and systems at serious risk.

Technical detail

Unauthenticated remote code execution vulnerability exists in the /RestAPI servlet endpoint due to improper access controls in the Struts framework configuration, specifically in the ImportTechnicians action. An attacker can exploit this without authentication to execute arbitrary code with server privileges, affecting ServiceDesk Plus (<11306), ServiceDesk Plus MSP (<10530), and SupportCenter Plus (<11014).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.