cbcvebase.
CVE-2021-44526
published 2021-12-23

CVE-2021-44526: Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.

PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.19%
86.5th percentile
Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.

Affected

15 ranges
VendorProductVersion rangeFixed in
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——
zohocorpmanageengine_servicedesk_plus——

Detection & IOCsextracted from sources · hover to see the quote

  • →CVE-2021-44526 exploits a flaw in application filters used in the list view of ServiceDesk Plus; attacker uses a crafted URL to access a servlet that should only be available to an authenticated user ↗
  • →Affected product versions: ServiceDesk Plus on-premises versions up to and including 12002 are vulnerable; version 12003 and above contain the fix ↗
  • ·The authentication bypass only applies to certain admin configurations of ServiceDesk Plus ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.