cbcvebase.
CVE-2021-40175
published 2021-08-29

CVE-2021-40175: Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution.

PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
7.01%
93.4th percentile
Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution.

Affected

6 ranges
VendorProductVersion rangeFixed in
zohocorplog360<= 5.2.2—
zohocorpmanageengine_cloud_security_plus< 4.14.1
zohocorpmanageengine_cloud_security_plus<= 4.1.1.7—
zohocorpmanageengine_cloud_security_plus——
zohocorpmanageengine_log360<= 5.1—
zohocorpmanageengine_log360——

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.