Lucene search

[email protected]CVE-2021-44675

HistoryDec 20, 2021 - 3:15 p.m.

CVE-2021-44675

2021-12-2015:15:07

CWE-287

[email protected]

web.nvd.nist.gov

cve-2021-44675

zoho

manageengine

servicedesk plus msp

unauthenticated

remote code execution

vulnerability

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.2%

JSON

Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required.

Affected configurations

NVD

Node

zohocorpmanageengine_servicedesk_plus_mspRange≤10.5

zohocorpmanageengine_servicedesk_plus_mspMatch10.510500

zohocorpmanageengine_servicedesk_plus_mspMatch10.510501

zohocorpmanageengine_servicedesk_plus_mspMatch10.510502

zohocorpmanageengine_servicedesk_plus_mspMatch10.510503

zohocorpmanageengine_servicedesk_plus_mspMatch10.510504

zohocorpmanageengine_servicedesk_plus_mspMatch10.510505

zohocorpmanageengine_servicedesk_plus_mspMatch10.510506

zohocorpmanageengine_servicedesk_plus_mspMatch10.510507

zohocorpmanageengine_servicedesk_plus_mspMatch10.510508

zohocorpmanageengine_servicedesk_plus_mspMatch10.510509

zohocorpmanageengine_servicedesk_plus_mspMatch10.510510

zohocorpmanageengine_servicedesk_plus_mspMatch10.510511

zohocorpmanageengine_servicedesk_plus_mspMatch10.510512

zohocorpmanageengine_servicedesk_plus_mspMatch10.510513

zohocorpmanageengine_servicedesk_plus_mspMatch10.510514

zohocorpmanageengine_servicedesk_plus_mspMatch10.510515

zohocorpmanageengine_servicedesk_plus_mspMatch10.510516

zohocorpmanageengine_servicedesk_plus_mspMatch10.510517

zohocorpmanageengine_servicedesk_plus_mspMatch10.510518

zohocorpmanageengine_servicedesk_plus_mspMatch10.510519

zohocorpmanageengine_servicedesk_plus_mspMatch10.510520

zohocorpmanageengine_servicedesk_plus_mspMatch10.510521

zohocorpmanageengine_servicedesk_plus_mspMatch10.510522

zohocorpmanageengine_servicedesk_plus_mspMatch10.510523

zohocorpmanageengine_servicedesk_plus_mspMatch10.510524

zohocorpmanageengine_servicedesk_plus_mspMatch10.510525

zohocorpmanageengine_servicedesk_plus_mspMatch10.510526

zohocorpmanageengine_servicedesk_plus_mspMatch10.510527

zohocorpmanageengine_servicedesk_plus_mspMatch10.510528

zohocorpmanageengine_servicedesk_plus_mspMatch10.510529

zohocorpmanageengine_servicedesk_plus_mspMatch10.510530

zohocorpmanageengine_servicedesk_plus_mspMatch10.510531

zohocorpmanageengine_servicedesk_plus_mspMatch10.510532

zohocorpmanageengine_servicedesk_plus_mspMatch10.510533

CPENameOperatorVersion
zohocorp:manageengine_servicedesk_plus_mspzohocorp manageengine servicedesk plus msple10.5

CPE	Name	Operator	Version
zohocorp:manageengine_servicedesk_plus_msp	zohocorp manageengine servicedesk plus msp	le	10.5

References

pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerabilities-in-servicedesk-plus-msp-that-could-lead-to-remote-code-execution

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.2%

JSON

Related for CVE-2021-44675

nvd1 cvelist1 prion1