Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
CVE-2021-44077
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
O que é
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
CISA: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
O que fazer
Apply updates per vendor instructions.
Prazo para as agências federais dos EUA: 15 de dezembro de 2021
- Adicionada à lista da CISA
- 1 de dezembro de 2021
- Publicada
- 29 de novembro de 2021
- Gravidade
- Crítica 9,8 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 93% entre os 0,2% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-306
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (5)
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticat…
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerabil…
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticat…
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticat…
- http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html
Mais falhas exploradas de Zoho
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 7 de mar. de 2023 | ADSelfService Plus Remote Code Execution | ManageEngine | Média 6,8 | 71% |
| 23 de jan. de 2023 | Multiple Products Remote Code Execution | ManageEngine | Crítica 9,8 | 99,8% |
| 22 de set. de 2022 | Multiple Products Remote Code Execution | ManageEngine | Crítica 9,8 | 99,9% |
| 10 de dez. de 2021 | Authentication Bypass | Desktop Central | Crítica 9,8 | 99,9% |
| 1 de dez. de 2021 | ManageEngine ServiceDesk Authentication Bypass | ManageEngine ServiceDesk Plus (SDP) | Crítica 9,8 | 99,8% |
| 3 de nov. de 2021 | ServiceDesk Plus (SDP) File Upload | ManageEngine | Alto 7,5 | 63% |
| 3 de nov. de 2021 | Desktop Central File Upload | ManageEngine | Crítica 9,8 | 99,9% |
| 3 de nov. de 2021 | ADSelfService Plus Authentication Bypass | ManageEngine | Crítica 9,8 | 99% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.