Lucene search
HistorySep 07, 2021 - 5:15 p.m.
CVE-2021-40539
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.975 High
EPSS
Percentile
100.0%
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Affected configurations
Node
zohocorpmanageengine_adselfservice_plusMatch4.54510
ORzohocorpmanageengine_adselfservice_plusMatch4.54511
ORzohocorpmanageengine_adselfservice_plusMatch4.54520
ORzohocorpmanageengine_adselfservice_plusMatch4.54522
ORzohocorpmanageengine_adselfservice_plusMatch4.54531
ORzohocorpmanageengine_adselfservice_plusMatch4.54540
ORzohocorpmanageengine_adselfservice_plusMatch4.54543
ORzohocorpmanageengine_adselfservice_plusMatch4.54544
ORzohocorpmanageengine_adselfservice_plusMatch4.54550
ORzohocorpmanageengine_adselfservice_plusMatch4.54560
ORzohocorpmanageengine_adselfservice_plusMatch4.54570
ORzohocorpmanageengine_adselfservice_plusMatch4.54571
ORzohocorpmanageengine_adselfservice_plusMatch4.54572
ORzohocorpmanageengine_adselfservice_plusMatch4.54580
ORzohocorpmanageengine_adselfservice_plusMatch4.54590
ORzohocorpmanageengine_adselfservice_plusMatch4.54591
ORzohocorpmanageengine_adselfservice_plusMatch4.54592
ORzohocorpmanageengine_adselfservice_plusMatch5.05000
ORzohocorpmanageengine_adselfservice_plusMatch5.05001
ORzohocorpmanageengine_adselfservice_plusMatch5.05002
ORzohocorpmanageengine_adselfservice_plusMatch5.05010
ORzohocorpmanageengine_adselfservice_plusMatch5.05011
ORzohocorpmanageengine_adselfservice_plusMatch5.05020
ORzohocorpmanageengine_adselfservice_plusMatch5.05021
ORzohocorpmanageengine_adselfservice_plusMatch5.05022
ORzohocorpmanageengine_adselfservice_plusMatch5.05030
ORzohocorpmanageengine_adselfservice_plusMatch5.05032
ORzohocorpmanageengine_adselfservice_plusMatch5.05040
ORzohocorpmanageengine_adselfservice_plusMatch5.05041
ORzohocorpmanageengine_adselfservice_plusMatch5.0.6
ORzohocorpmanageengine_adselfservice_plusMatch5.15100
ORzohocorpmanageengine_adselfservice_plusMatch5.15101
ORzohocorpmanageengine_adselfservice_plusMatch5.15102
ORzohocorpmanageengine_adselfservice_plusMatch5.15103
ORzohocorpmanageengine_adselfservice_plusMatch5.15104
ORzohocorpmanageengine_adselfservice_plusMatch5.15105
ORzohocorpmanageengine_adselfservice_plusMatch5.15106
ORzohocorpmanageengine_adselfservice_plusMatch5.15107
ORzohocorpmanageengine_adselfservice_plusMatch5.15108
ORzohocorpmanageengine_adselfservice_plusMatch5.15109
ORzohocorpmanageengine_adselfservice_plusMatch5.15110
ORzohocorpmanageengine_adselfservice_plusMatch5.15111
ORzohocorpmanageengine_adselfservice_plusMatch5.15112
ORzohocorpmanageengine_adselfservice_plusMatch5.15113
ORzohocorpmanageengine_adselfservice_plusMatch5.15114
ORzohocorpmanageengine_adselfservice_plusMatch5.15115
ORzohocorpmanageengine_adselfservice_plusMatch5.15116
ORzohocorpmanageengine_adselfservice_plusMatch5.25200
ORzohocorpmanageengine_adselfservice_plusMatch5.25201
ORzohocorpmanageengine_adselfservice_plusMatch5.25202
ORzohocorpmanageengine_adselfservice_plusMatch5.25203
ORzohocorpmanageengine_adselfservice_plusMatch5.25204
ORzohocorpmanageengine_adselfservice_plusMatch5.25205
ORzohocorpmanageengine_adselfservice_plusMatch5.25206
ORzohocorpmanageengine_adselfservice_plusMatch5.25207
ORzohocorpmanageengine_adselfservice_plusMatch5.35300
ORzohocorpmanageengine_adselfservice_plusMatch5.35301
ORzohocorpmanageengine_adselfservice_plusMatch5.35302
ORzohocorpmanageengine_adselfservice_plusMatch5.35303
ORzohocorpmanageengine_adselfservice_plusMatch5.35304
ORzohocorpmanageengine_adselfservice_plusMatch5.35305
ORzohocorpmanageengine_adselfservice_plusMatch5.35306
ORzohocorpmanageengine_adselfservice_plusMatch5.35307
ORzohocorpmanageengine_adselfservice_plusMatch5.35308
ORzohocorpmanageengine_adselfservice_plusMatch5.35309
ORzohocorpmanageengine_adselfservice_plusMatch5.35310
ORzohocorpmanageengine_adselfservice_plusMatch5.35311
ORzohocorpmanageengine_adselfservice_plusMatch5.35312
ORzohocorpmanageengine_adselfservice_plusMatch5.35313
ORzohocorpmanageengine_adselfservice_plusMatch5.35314
ORzohocorpmanageengine_adselfservice_plusMatch5.35315
ORzohocorpmanageengine_adselfservice_plusMatch5.35316
ORzohocorpmanageengine_adselfservice_plusMatch5.35317
ORzohocorpmanageengine_adselfservice_plusMatch5.35318
ORzohocorpmanageengine_adselfservice_plusMatch5.35319
ORzohocorpmanageengine_adselfservice_plusMatch5.35320
ORzohocorpmanageengine_adselfservice_plusMatch5.35321
ORzohocorpmanageengine_adselfservice_plusMatch5.35322
ORzohocorpmanageengine_adselfservice_plusMatch5.35323
ORzohocorpmanageengine_adselfservice_plusMatch5.35324
ORzohocorpmanageengine_adselfservice_plusMatch5.35325
ORzohocorpmanageengine_adselfservice_plusMatch5.35326
ORzohocorpmanageengine_adselfservice_plusMatch5.35327
ORzohocorpmanageengine_adselfservice_plusMatch5.35328
ORzohocorpmanageengine_adselfservice_plusMatch5.35329
ORzohocorpmanageengine_adselfservice_plusMatch5.35330
ORzohocorpmanageengine_adselfservice_plusMatch5.45400
ORzohocorpmanageengine_adselfservice_plusMatch5.5-
ORzohocorpmanageengine_adselfservice_plusMatch5.55500
ORzohocorpmanageengine_adselfservice_plusMatch5.55501
ORzohocorpmanageengine_adselfservice_plusMatch5.55502
ORzohocorpmanageengine_adselfservice_plusMatch5.55503
ORzohocorpmanageengine_adselfservice_plusMatch5.55504
ORzohocorpmanageengine_adselfservice_plusMatch5.55505
ORzohocorpmanageengine_adselfservice_plusMatch5.55506
ORzohocorpmanageengine_adselfservice_plusMatch5.55507
ORzohocorpmanageengine_adselfservice_plusMatch5.55508
ORzohocorpmanageengine_adselfservice_plusMatch5.55509
ORzohocorpmanageengine_adselfservice_plusMatch5.55510
ORzohocorpmanageengine_adselfservice_plusMatch5.55511
ORzohocorpmanageengine_adselfservice_plusMatch5.55512
ORzohocorpmanageengine_adselfservice_plusMatch5.55513
ORzohocorpmanageengine_adselfservice_plusMatch5.55514
ORzohocorpmanageengine_adselfservice_plusMatch5.55515
ORzohocorpmanageengine_adselfservice_plusMatch5.55516
ORzohocorpmanageengine_adselfservice_plusMatch5.55517
ORzohocorpmanageengine_adselfservice_plusMatch5.55518
ORzohocorpmanageengine_adselfservice_plusMatch5.55519
ORzohocorpmanageengine_adselfservice_plusMatch5.55520
ORzohocorpmanageengine_adselfservice_plusMatch5.55521
ORzohocorpmanageengine_adselfservice_plusMatch5.65600
ORzohocorpmanageengine_adselfservice_plusMatch5.65601
ORzohocorpmanageengine_adselfservice_plusMatch5.65602
ORzohocorpmanageengine_adselfservice_plusMatch5.65603
ORzohocorpmanageengine_adselfservice_plusMatch5.65604
ORzohocorpmanageengine_adselfservice_plusMatch5.65605
ORzohocorpmanageengine_adselfservice_plusMatch5.65606
ORzohocorpmanageengine_adselfservice_plusMatch5.65607
ORzohocorpmanageengine_adselfservice_plusMatch5.75607
ORzohocorpmanageengine_adselfservice_plusMatch5.75700
ORzohocorpmanageengine_adselfservice_plusMatch5.75701
ORzohocorpmanageengine_adselfservice_plusMatch5.75702
ORzohocorpmanageengine_adselfservice_plusMatch5.75703
ORzohocorpmanageengine_adselfservice_plusMatch5.75704
ORzohocorpmanageengine_adselfservice_plusMatch5.75705
ORzohocorpmanageengine_adselfservice_plusMatch5.75706
ORzohocorpmanageengine_adselfservice_plusMatch5.75707
ORzohocorpmanageengine_adselfservice_plusMatch5.75708
ORzohocorpmanageengine_adselfservice_plusMatch5.75709
ORzohocorpmanageengine_adselfservice_plusMatch5.75710
ORzohocorpmanageengine_adselfservice_plusMatch5.8-
ORzohocorpmanageengine_adselfservice_plusMatch5.85800
ORzohocorpmanageengine_adselfservice_plusMatch5.85801
ORzohocorpmanageengine_adselfservice_plusMatch5.85802
ORzohocorpmanageengine_adselfservice_plusMatch5.85803
ORzohocorpmanageengine_adselfservice_plusMatch5.85804
ORzohocorpmanageengine_adselfservice_plusMatch5.85805
ORzohocorpmanageengine_adselfservice_plusMatch5.85806
ORzohocorpmanageengine_adselfservice_plusMatch5.85807
ORzohocorpmanageengine_adselfservice_plusMatch5.85808
ORzohocorpmanageengine_adselfservice_plusMatch5.85809
ORzohocorpmanageengine_adselfservice_plusMatch5.85810
ORzohocorpmanageengine_adselfservice_plusMatch5.85811
ORzohocorpmanageengine_adselfservice_plusMatch5.85812
ORzohocorpmanageengine_adselfservice_plusMatch5.85813
ORzohocorpmanageengine_adselfservice_plusMatch5.85814
ORzohocorpmanageengine_adselfservice_plusMatch5.85815
ORzohocorpmanageengine_adselfservice_plusMatch5.85816
ORzohocorpmanageengine_adselfservice_plusMatch6.0-
ORzohocorpmanageengine_adselfservice_plusMatch6.06000
ORzohocorpmanageengine_adselfservice_plusMatch6.06001
ORzohocorpmanageengine_adselfservice_plusMatch6.06002
ORzohocorpmanageengine_adselfservice_plusMatch6.06003
ORzohocorpmanageengine_adselfservice_plusMatch6.06004
ORzohocorpmanageengine_adselfservice_plusMatch6.06005
ORzohocorpmanageengine_adselfservice_plusMatch6.06006
ORzohocorpmanageengine_adselfservice_plusMatch6.06007
ORzohocorpmanageengine_adselfservice_plusMatch6.06008
ORzohocorpmanageengine_adselfservice_plusMatch6.06009
ORzohocorpmanageengine_adselfservice_plusMatch6.06012
ORzohocorpmanageengine_adselfservice_plusMatch6.06013
ORzohocorpmanageengine_adselfservice_plusMatch6.1-
ORzohocorpmanageengine_adselfservice_plusMatch6.16100
ORzohocorpmanageengine_adselfservice_plusMatch6.16101
ORzohocorpmanageengine_adselfservice_plusMatch6.16102
ORzohocorpmanageengine_adselfservice_plusMatch6.16103
ORzohocorpmanageengine_adselfservice_plusMatch6.16104
ORzohocorpmanageengine_adselfservice_plusMatch6.16105
ORzohocorpmanageengine_adselfservice_plusMatch6.16106
ORzohocorpmanageengine_adselfservice_plusMatch6.16113
Related
cisa
cisa
Zoho Releases Security Update for ADSelfService Plus
2021-09-07 00:00:00
Updated: APT Exploitation of ManageEngine ADSelfService Plus Vulnerability
2021-11-19 00:00:00
checkpoint_advisories
checkpoint_advisories
Zoho ManageEngine ADSelfService Plus Authentication Bypass (CVE-2021-40539)
2021-11-14 00:00:00
prion
prion
Authentication flaw
2021-09-07 17:15:00
nuclei
nuclei
nessus
nessus
ManageEngine Log360 < Build 5229 REST API Restriction Bypass RCE
2021-09-24 00:00:00
ManageEngine EventLog Analyzer < Build 12201 REST API Restriction Bypass RCE
2021-10-04 00:00:00
ManageEngine ADSelfService Plus < build 6114 REST API Authentication Bypass
2021-09-08 00:00:00
cisa_kev
cisa_kev
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
2021-11-03 00:00:00
zdt
zdt
mmpc
mmpc
Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus
2021-11-09 00:24:55
Patch me if you can: Cyberattack Series
2023-06-29 16:00:00
metasploit
metasploit
ManageEngine ADSelfService Plus CVE-2021-40539
2021-11-24 01:05:09
cve
cve
CVE-2021-40539
2021-09-07 17:15:07
threatpost
threatpost
CISA, FBI: State-Backed APTs Are Exploiting Critical Zoho Bug
2021-09-16 21:09:23
Zoho Password Manager Flaw Torched by Godzilla Webshell, New Data Stealer
2021-11-08 16:38:05
FBI: Another Zoho ManageEngine Zero-Day Under Active Attack
2021-12-21 14:42:02
thn
thn
mssecure
mssecure
Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus
2021-11-09 00:24:55
Patch me if you can: Cyberattack Series
2023-06-29 16:00:00
krebs
krebs
Red Cross Hack Linked to Iranian Influence Operation?
2022-02-16 16:44:19
malwarebytes
malwarebytes
FBI and CISA warn of APT groups exploiting ADSelfService Plus
2021-09-17 13:48:46
Security vulnerabilities: 5 times that organizations got hacked
2022-06-21 10:04:02
2022's most routinely exploited vulnerabilities—history repeats
2023-08-07 18:30:00
attackerkb
attackerkb
CVE-2021-40539
2021-09-07 00:00:00
githubexploit
githubexploit
packetstorm
packetstorm
ManageEngine ADSelfService Plus Authentication Bypass / Code Execution
2021-11-27 00:00:00
ics
ics
cvelist
cvelist
CVE-2021-40539
2021-09-07 16:06:58
rapid7blog
rapid7blog
Opportunistic Exploitation of Zoho ManageEngine and Sitecore CVEs
2021-11-09 16:59:41
Metasploit Wrap-Up
2021-11-26 17:21:03
What's New in InsightVM: Q3 2021 in Review
2021-10-08 13:30:00
avleonov
avleonov
Vulnerability Management news and publications #2
2022-08-14 11:30:44
Joint Advisory AA22-279A and Vulristics
2022-10-21 20:10:13
qualysblog
qualysblog
Qualys Tackles 2022’s Top Routinely Exploited Cyber Vulnerabilities
2023-08-24 19:07:05
CISA Alert: Top 15 Routinely Exploited Vulnerabilities
2022-05-06 12:19:24
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.975 High
EPSS
Percentile
100.0%
Related for NVD:CVE-2021-40539