Lucene search

[email protected]NVD:CVE-2021-44675

HistoryDec 20, 2021 - 3:15 p.m.

CVE-2021-44675

2021-12-2015:15:07

CWE-287

[email protected]

web.nvd.nist.gov

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

72.2%

JSON

Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required.

Affected configurations

NVD

Node

zohocorpmanageengine_servicedesk_plus_mspRange≤10.5

zohocorpmanageengine_servicedesk_plus_mspMatch10.510500

zohocorpmanageengine_servicedesk_plus_mspMatch10.510501

zohocorpmanageengine_servicedesk_plus_mspMatch10.510502

zohocorpmanageengine_servicedesk_plus_mspMatch10.510503

zohocorpmanageengine_servicedesk_plus_mspMatch10.510504

zohocorpmanageengine_servicedesk_plus_mspMatch10.510505

zohocorpmanageengine_servicedesk_plus_mspMatch10.510506

zohocorpmanageengine_servicedesk_plus_mspMatch10.510507

zohocorpmanageengine_servicedesk_plus_mspMatch10.510508

zohocorpmanageengine_servicedesk_plus_mspMatch10.510509

zohocorpmanageengine_servicedesk_plus_mspMatch10.510510

zohocorpmanageengine_servicedesk_plus_mspMatch10.510511

zohocorpmanageengine_servicedesk_plus_mspMatch10.510512

zohocorpmanageengine_servicedesk_plus_mspMatch10.510513

zohocorpmanageengine_servicedesk_plus_mspMatch10.510514

zohocorpmanageengine_servicedesk_plus_mspMatch10.510515

zohocorpmanageengine_servicedesk_plus_mspMatch10.510516

zohocorpmanageengine_servicedesk_plus_mspMatch10.510517

zohocorpmanageengine_servicedesk_plus_mspMatch10.510518

zohocorpmanageengine_servicedesk_plus_mspMatch10.510519

zohocorpmanageengine_servicedesk_plus_mspMatch10.510520

zohocorpmanageengine_servicedesk_plus_mspMatch10.510521

zohocorpmanageengine_servicedesk_plus_mspMatch10.510522

zohocorpmanageengine_servicedesk_plus_mspMatch10.510523

zohocorpmanageengine_servicedesk_plus_mspMatch10.510524

zohocorpmanageengine_servicedesk_plus_mspMatch10.510525

zohocorpmanageengine_servicedesk_plus_mspMatch10.510526

zohocorpmanageengine_servicedesk_plus_mspMatch10.510527

zohocorpmanageengine_servicedesk_plus_mspMatch10.510528

zohocorpmanageengine_servicedesk_plus_mspMatch10.510529

zohocorpmanageengine_servicedesk_plus_mspMatch10.510530

zohocorpmanageengine_servicedesk_plus_mspMatch10.510531

zohocorpmanageengine_servicedesk_plus_mspMatch10.510532

zohocorpmanageengine_servicedesk_plus_mspMatch10.510533

References

pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerabilities-in-servicedesk-plus-msp-that-could-lead-to-remote-code-execution

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

72.2%

JSON

Related for NVD:CVE-2021-44675

cvelist1 cve1 prion1