Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
CVE-2021-44077
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
What it is
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
CISA: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: December 15, 2021
- Added to the CISA list
- December 1, 2021
- Published
- November 29, 2021
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 93% in the top 0.2% of all known vulnerabilities
- Weakness
- CWE-306
- More details
- NVD · CVE.org · CISA
All references (5)
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticat…
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerabil…
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticat…
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticat…
- http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html
More exploited flaws from Zoho
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 7, 2023 | ADSelfService Plus Remote Code Execution | ManageEngine | Medium 6.8 | 71% |
| Jan 23, 2023 | Multiple Products Remote Code Execution | ManageEngine | Critical 9.8 | 99.8% |
| Sep 22, 2022 | Multiple Products Remote Code Execution | ManageEngine | Critical 9.8 | 99.9% |
| Dec 10, 2021 | Authentication Bypass | Desktop Central | Critical 9.8 | 99.9% |
| Dec 1, 2021 | ManageEngine ServiceDesk Authentication Bypass | ManageEngine ServiceDesk Plus (SDP) | Critical 9.8 | 99.8% |
| Nov 3, 2021 | ServiceDesk Plus (SDP) File Upload | ManageEngine | High 7.5 | 63% |
| Nov 3, 2021 | Desktop Central File Upload | ManageEngine | Critical 9.8 | 99.9% |
| Nov 3, 2021 | ADSelfService Plus Authentication Bypass | ManageEngine | Critical 9.8 | 99% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.