Zoho · ManageEngine ServiceDesk Plus (SDP)

CVE-2021-37415

Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 99.8%

What it is

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.

CISA: Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: December 15, 2021

Added to the CISA list: December 1, 2021
Published: September 1, 2021
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99.8% in the top 0.1% of all known vulnerabilities
Weakness: CWE-306
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Zoho

Added	Vulnerability	Product	Severity	Attack chance
Mar 7, 2023	ADSelfService Plus Remote Code ExecutionCVE-2022-28810	ManageEngine	Medium 6.8	71%
Jan 23, 2023	Multiple Products Remote Code ExecutionCVE-2022-47966used by ransomware	ManageEngine	Critical 9.8	99.8%
Sep 22, 2022	Multiple Products Remote Code ExecutionCVE-2022-35405	ManageEngine	Critical 9.8	99.9%
Dec 10, 2021	Authentication BypassCVE-2021-44515	Desktop Central	Critical 9.8	99.9%
Dec 1, 2021	ManageEngine ServiceDesk Plus Remote Code ExecutionCVE-2021-44077	ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus	Critical 9.8	93%
Nov 3, 2021	ServiceDesk Plus (SDP) File UploadCVE-2019-8394	ManageEngine	High 7.5	63%
Nov 3, 2021	Desktop Central File UploadCVE-2020-10189	ManageEngine	Critical 9.8	99.9%
Nov 3, 2021	ADSelfService Plus Authentication BypassCVE-2021-40539used by ransomware	ManageEngine	Critical 9.8	99%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.