Zoho · ManageEngine ServiceDesk Plus (SDP)
CVE-2021-37415
Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
Explorada em ataques
Crítica 9,8 Chance de ataque: 99,8%
O que é
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
CISA: Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 15 de dezembro de 2021
Mais falhas exploradas de Zoho
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 7 de mar. de 2023 | ADSelfService Plus Remote Code Execution | ManageEngine | Média 6,8 | 71% |
| 23 de jan. de 2023 | Multiple Products Remote Code Execution | ManageEngine | Crítica 9,8 | 99,8% |
| 22 de set. de 2022 | Multiple Products Remote Code Execution | ManageEngine | Crítica 9,8 | 99,9% |
| 10 de dez. de 2021 | Authentication Bypass | Desktop Central | Crítica 9,8 | 99,9% |
| 1 de dez. de 2021 | ManageEngine ServiceDesk Plus Remote Code Execution | ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Crítica 9,8 | 93% |
| 3 de nov. de 2021 | ServiceDesk Plus (SDP) File Upload | ManageEngine | Alto 7,5 | 63% |
| 3 de nov. de 2021 | Desktop Central File Upload | ManageEngine | Crítica 9,8 | 99,9% |
| 3 de nov. de 2021 | ADSelfService Plus Authentication Bypass | ManageEngine | Crítica 9,8 | 99% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.