CVE-2021-40539

🗓️ 07 Sep 2021 16:06:58Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 6 Media mentions👁 1526 Views🌐 WEB

Zoho ManageEngine ADSelfService Plus vulnerability CVE-2021-4053

Reporter	Title	Published	Views	Family All 80
zdt	ManageEngine ADSelfService Plus Authentication Bypass / Code Execution Exploit	27 Nov 202100:00	–	zdt
GithubExploit	Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus	12 Oct 202409:01	–	githubexploit
GithubExploit	Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus	16 Oct 202411:23	–	githubexploit
GithubExploit	Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus	3 Nov 202114:49	–	githubexploit
GithubExploit	Exploit for Use of Incorrectly-Resolved Name or Reference in Zohocorp Manageengine_Adselfservice_Plus	12 Oct 202409:09	–	githubexploit
ICS	APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus	22 Nov 202112:00	–	ics
ICS	2021 Top Routinely Exploited Vulnerabilities	28 Apr 202212:00	–	ics
ICS	Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors	6 Oct 202212:00	–	ics
ICS	People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection	24 May 202312:00	–	ics
ICS	2022 Top Routinely Exploited Vulnerabilities	3 Aug 202312:00	–	ics

NVD

Node

Source	Link
manageengine	www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
manageengine	www.manageengine.com/
packetstormsecurity	www.packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
methodToCall	request body	/RestAPI/LogonCustomization	REST API authentication bypass via LogonCustomization endpoint using methodToCall to bypass authentication.	CWE-706
CERTIFICATE_PATH	binary	/RestAPI/LogonCustomization	Upload payload JAR via multipart/form-data to LogonCustomization using CERTIFICATE_PATH to drop the payload.	CWE-706
methodToCall	request body	/RestAPI/Connection	Execute payload by calling openSSLTool with parameters to generate CSR, triggering RCE.	CWE-706
action	request body	/RestAPI/Connection	Execute payload by calling openSSLTool with parameters to generate CSR, triggering RCE.	CWE-706
VALIDITY	request body	/RestAPI/Connection	Execute payload by calling openSSLTool with parameters to generate CSR, triggering RCE.	CWE-706

17 Jun 2026 04:07Current

9.9Critical risk

Vulners AI Score9.9

CVSS 27.5

CVSS 3.19.8

EPSS0.9896

SSVC