2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2021-37415" ,
"sourceIdentifier" : "cve@mitre.org" ,
"published" : "2021-09-01T06:15:06.530" ,
2025-02-03 17:04:00 +00:00
"lastModified" : "2025-02-03T16:15:31.193" ,
2025-03-23 03:03:54 +00:00
"vulnStatus" : "Undergoing Analysis" ,
2024-07-14 02:06:08 +00:00
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication."
} ,
{
"lang" : "es" ,
"value" : "Zoho ManageEngine ServiceDesk Plus versiones anteriores a 11302, es vulnerable a una omisi\u00f3n de autenticaci\u00f3n que permite algunas URLs REST-API sin autenticaci\u00f3n"
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 9.8 ,
"baseSeverity" : "CRITICAL" ,
2023-04-24 12:24:31 +02:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "HIGH"
2023-04-24 12:24:31 +02:00
} ,
"exploitabilityScore" : 3.9 ,
"impactScore" : 5.9
2025-02-03 17:04:00 +00:00
} ,
{
"source" : "134c704f-9b21-4f2e-91b3-4a467353bcc0" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" ,
"baseScore" : 9.8 ,
"baseSeverity" : "CRITICAL" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "HIGH" ,
"availabilityImpact" : "HIGH"
} ,
"exploitabilityScore" : 3.9 ,
"impactScore" : 5.9
2023-04-24 12:24:31 +02:00
}
] ,
"cvssMetricV2" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "2.0" ,
"vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 7.5 ,
2023-04-24 12:24:31 +02:00
"accessVector" : "NETWORK" ,
"accessComplexity" : "LOW" ,
"authentication" : "NONE" ,
"confidentialityImpact" : "PARTIAL" ,
"integrityImpact" : "PARTIAL" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "PARTIAL"
2023-04-24 12:24:31 +02:00
} ,
"baseSeverity" : "HIGH" ,
"exploitabilityScore" : 10.0 ,
"impactScore" : 6.4 ,
"acInsufInfo" : false ,
"obtainAllPrivilege" : false ,
"obtainUserPrivilege" : false ,
"obtainOtherPrivilege" : false ,
"userInteractionRequired" : false
}
]
} ,
2024-12-08 03:06:42 +00:00
"cisaExploitAdd" : "2021-12-01" ,
"cisaActionDue" : "2021-12-15" ,
"cisaRequiredAction" : "Apply updates per vendor instructions." ,
"cisaVulnerabilityName" : "Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability" ,
2023-04-24 12:24:31 +02:00
"weaknesses" : [
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-306"
}
]
2025-02-03 17:04:00 +00:00
} ,
{
"source" : "134c704f-9b21-4f2e-91b3-4a467353bcc0" ,
"type" : "Secondary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-306"
}
]
2023-04-24 12:24:31 +02:00
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11005:*:*:*:*:*:*" ,
"matchCriteriaId" : "AA22E70B-F031-4ADA-B8CE-4B8FF6957F0F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11006:*:*:*:*:*:*" ,
"matchCriteriaId" : "D79D1272-025B-40E2-BE9D-141577DC1FD0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11007:*:*:*:*:*:*" ,
"matchCriteriaId" : "725B0345-D7BD-4302-B81A-C17115FF1070"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11008:*:*:*:*:*:*" ,
"matchCriteriaId" : "2D0E9A21-D7CB-4129-925F-9D3105071FF2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11009:*:*:*:*:*:*" ,
"matchCriteriaId" : "01750E0E-29E5-4FFA-8194-813FA363467E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11010:*:*:*:*:*:*" ,
"matchCriteriaId" : "E2C953DF-2F29-488E-B4DD-F64BA0BD6A39"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.0:11011:*:*:*:*:*:*" ,
"matchCriteriaId" : "D8774F16-1A2C-4A91-B132-DE8B1D29DB43"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "298623A4-60DF-41F6-B2FD-ED84E6D2C06C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11100:*:*:*:*:*:*" ,
"matchCriteriaId" : "523C554B-076C-4F59-A04B-92D57CDAF7E8"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11101:*:*:*:*:*:*" ,
"matchCriteriaId" : "3A85A576-6144-41DB-9ACF-1DD93D5A8852"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11102:*:*:*:*:*:*" ,
"matchCriteriaId" : "02EC45C8-CD28-4B2A-A1FA-1EA9F8B392F7"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11103:*:*:*:*:*:*" ,
"matchCriteriaId" : "1A4A02F3-4427-4E4C-9245-EF5D73A7AC71"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11104:*:*:*:*:*:*" ,
"matchCriteriaId" : "063D71A3-F1DF-486A-92E1-338C6D5C9E8E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11105:*:*:*:*:*:*" ,
"matchCriteriaId" : "14A2C9CC-D434-41A7-A01A-03933675556A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11106:*:*:*:*:*:*" ,
"matchCriteriaId" : "B283BD0B-22E3-4AD3-AE4B-07431DA00E5C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11107:*:*:*:*:*:*" ,
"matchCriteriaId" : "42FDD0DE-EEE7-4D82-B9CA-EFA052728C7D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11108:*:*:*:*:*:*" ,
"matchCriteriaId" : "DED26B68-E61F-4575-85AD-48EC2E128712"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11109:*:*:*:*:*:*" ,
"matchCriteriaId" : "F69FF4ED-AFCE-49A2-AD4C-E6A870FFA32D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11110:*:*:*:*:*:*" ,
"matchCriteriaId" : "7AFCBA54-26E4-4C56-82BB-135FCA210419"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11111:*:*:*:*:*:*" ,
"matchCriteriaId" : "9B594A55-DBF5-4C3F-855F-843A7F26DFEF"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11112:*:*:*:*:*:*" ,
"matchCriteriaId" : "53E10E88-28AE-4F01-AE6E-C76CB3309F69"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11113:*:*:*:*:*:*" ,
"matchCriteriaId" : "1909D29B-7532-4C60-9F16-BD310022E2A9"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11114:*:*:*:*:*:*" ,
"matchCriteriaId" : "8B5FA504-BFA4-4740-A3C0-B917AF301E72"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11115:*:*:*:*:*:*" ,
"matchCriteriaId" : "2694C1E1-7596-4183-9B09-4BB5BA5C5551"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11116:*:*:*:*:*:*" ,
"matchCriteriaId" : "31A7FA61-399B-4778-828C-BB65548966AF"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11117:*:*:*:*:*:*" ,
"matchCriteriaId" : "E33CAA7E-2F7B-4833-94F6-6C0F607903CD"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11118:*:*:*:*:*:*" ,
"matchCriteriaId" : "81D5E4BB-41F6-46B7-98C7-43DE55785496"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11119:*:*:*:*:*:*" ,
"matchCriteriaId" : "8400D7D8-D03D-4A5C-B533-A640A648238D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11120:*:*:*:*:*:*" ,
"matchCriteriaId" : "21E4107F-A0DC-4A53-9352-A442B563599C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11121:*:*:*:*:*:*" ,
"matchCriteriaId" : "42B90217-2981-4B2A-BB29-BF36F4C1494F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11122:*:*:*:*:*:*" ,
"matchCriteriaId" : "A96B5C8D-5689-405D-ADD7-8BA0E9755EB6"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11123:*:*:*:*:*:*" ,
"matchCriteriaId" : "0B621910-3AE7-4E92-9B6D-C015A8D4AC9F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11124:*:*:*:*:*:*" ,
"matchCriteriaId" : "9E480891-A40B-4184-B06D-26EC583FBA41"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11125:*:*:*:*:*:*" ,
"matchCriteriaId" : "8D8905CE-F981-4034-8193-533A4930D518"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11126:*:*:*:*:*:*" ,
"matchCriteriaId" : "79FBA595-2CDC-45E8-8840-34D17F09A5FB"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11127:*:*:*:*:*:*" ,
"matchCriteriaId" : "D462AC9D-8731-49D9-A760-5013B496C8C3"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11128:*:*:*:*:*:*" ,
"matchCriteriaId" : "332AB05B-3DC2-493F-8DB8-7DA93531D9BC"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11129:*:*:*:*:*:*" ,
"matchCriteriaId" : "A9ED77FC-F359-48AA-8A48-4009B25992D4"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11130:*:*:*:*:*:*" ,
"matchCriteriaId" : "98C4DC91-985F-413E-9F6F-27E93C1125E5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11131:*:*:*:*:*:*" ,
"matchCriteriaId" : "6841D87A-97FD-415B-931C-6407A36A1E96"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11132:*:*:*:*:*:*" ,
"matchCriteriaId" : "D1C4B37D-6983-430C-91C5-635D7EF51A5F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11133:*:*:*:*:*:*" ,
"matchCriteriaId" : "4E959106-3183-4D8A-888D-6379DC33234D"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11134:*:*:*:*:*:*" ,
"matchCriteriaId" : "72C74691-300E-4CD7-AD57-594586B12669"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11135:*:*:*:*:*:*" ,
"matchCriteriaId" : "1F60565E-3BDA-4BE3-B013-1BF4469B8B1B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11136:*:*:*:*:*:*" ,
"matchCriteriaId" : "6BD8A92A-AC27-4914-B36D-94829478D47A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11137:*:*:*:*:*:*" ,
"matchCriteriaId" : "7ED4E888-2EFA-4F7F-9503-59F34FF720D2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11138:*:*:*:*:*:*" ,
"matchCriteriaId" : "106A06E5-56E8-41D3-A059-7DA6737DABAE"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11139:*:*:*:*:*:*" ,
"matchCriteriaId" : "401AEAD2-183D-4E55-94AD-D24A9BE46D61"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11140:*:*:*:*:*:*" ,
"matchCriteriaId" : "AD69D55A-3975-4F1E-8D6F-E0074F83CCBE"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11141:*:*:*:*:*:*" ,
"matchCriteriaId" : "417D6E6A-C16A-4A76-8D65-31340834233E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11142:*:*:*:*:*:*" ,
"matchCriteriaId" : "1A040A5B-8C2A-4557-AB5E-1427B0F1E889"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11143:*:*:*:*:*:*" ,
"matchCriteriaId" : "207A81A8-02EF-4793-B047-46581BF7E60B"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11144:*:*:*:*:*:*" ,
"matchCriteriaId" : "194BEECD-F877-4D28-A534-E965D69C9EB9"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "E42B1B2B-7031-4DDA-B5D4-9D6A66BF6B23"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11200:*:*:*:*:*:*" ,
"matchCriteriaId" : "7D130762-4B49-4089-99A1-FEFD6B76AB8F"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11201:*:*:*:*:*:*" ,
"matchCriteriaId" : "CDC33E6B-81E2-4A15-8889-2CD709CF5E45"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11202:*:*:*:*:*:*" ,
"matchCriteriaId" : "E08A077E-B1AA-432A-B37A-AA603C8CD1FB"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11203:*:*:*:*:*:*" ,
"matchCriteriaId" : "69B73464-8627-4CCE-93CE-B312A9D7B35C"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11204:*:*:*:*:*:*" ,
"matchCriteriaId" : "51839FBE-A7E1-40FD-B44B-F9C8CA62E063"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11205:*:*:*:*:*:*" ,
"matchCriteriaId" : "7BE9BFCC-04AB-4053-949C-B2860E7E43B5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11206:*:*:*:*:*:*" ,
"matchCriteriaId" : "A2062399-67EA-4368-9629-60E4A59DDB29"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11207:*:*:*:*:*:*" ,
"matchCriteriaId" : "E9841B62-4C50-4A3A-8B54-BB0AEC8B1AA2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "7C2035DC-3D54-4D0A-B18A-8D5FAA15CF45"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:11300:*:*:*:*:*:*" ,
"matchCriteriaId" : "188135EF-9821-4325-A34F-AB6F430F5DDC"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.3:11301:*:*:*:*:*:*" ,
"matchCriteriaId" : "DC971E05-D69B-4688-861D-3D6357726CB6"
}
]
}
]
}
] ,
"references" : [
{
"url" : "https://www.manageengine.com" ,
"source" : "cve@mitre.org" ,
"tags" : [
2024-02-14 21:00:36 +00:00
"Product"
2023-04-24 12:24:31 +02:00
]
} ,
{
"url" : "https://www.manageengine.com/products/service-desk/on-premises/readme.html#11302" ,
"source" : "cve@mitre.org" ,
"tags" : [
2024-02-14 21:00:36 +00:00
"Release Notes"
2023-04-24 12:24:31 +02:00
]
2024-12-08 03:06:42 +00:00
} ,
{
"url" : "https://www.manageengine.com" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Product"
]
} ,
{
"url" : "https://www.manageengine.com/products/service-desk/on-premises/readme.html#11302" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Release Notes"
]
2023-04-24 12:24:31 +02:00
}
]
}
