Lucene search

MitreCVE-2021-44077

HistoryNov 29, 2021 - 4:15 a.m.

CVE-2021-44077

2021-11-2904:15:06

CWE-306

mitre

web.nvd.nist.gov

995

In Wild

cve-2021-44077

zoho

manageengine

servicedesk

remote code execution

security vulnerability

nvd

unauthenticated access

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.974

Percentile

99.9%

JSON

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.

Affected configurations

Nvd

Node

zohocorpmanageengine_servicedesk_plusMatch11.111138

zohocorpmanageengine_servicedesk_plusMatch11.111139

zohocorpmanageengine_servicedesk_plusMatch11.111140

zohocorpmanageengine_servicedesk_plusMatch11.111141

zohocorpmanageengine_servicedesk_plusMatch11.111142

zohocorpmanageengine_servicedesk_plusMatch11.111143

zohocorpmanageengine_servicedesk_plusMatch11.111144

zohocorpmanageengine_servicedesk_plusMatch11.111145

zohocorpmanageengine_servicedesk_plusMatch11.211200

zohocorpmanageengine_servicedesk_plusMatch11.211201

zohocorpmanageengine_servicedesk_plusMatch11.211202

zohocorpmanageengine_servicedesk_plusMatch11.211203

zohocorpmanageengine_servicedesk_plusMatch11.211204

zohocorpmanageengine_servicedesk_plusMatch11.211205

zohocorpmanageengine_servicedesk_plusMatch11.211206

zohocorpmanageengine_servicedesk_plusMatch11.211207

zohocorpmanageengine_servicedesk_plusMatch11.211208

zohocorpmanageengine_servicedesk_plusMatch11.211209

zohocorpmanageengine_servicedesk_plusMatch11.211210

zohocorpmanageengine_servicedesk_plusMatch11.211211

zohocorpmanageengine_servicedesk_plusMatch11.311300

zohocorpmanageengine_servicedesk_plusMatch11.311301

zohocorpmanageengine_servicedesk_plusMatch11.311302

zohocorpmanageengine_servicedesk_plusMatch11.311303

zohocorpmanageengine_servicedesk_plusMatch11.311304

zohocorpmanageengine_servicedesk_plusMatch11.311305

zohocorpmanageengine_servicedesk_plus_mspRange≤10.5

zohocorpmanageengine_servicedesk_plus_mspMatch10.510500

zohocorpmanageengine_servicedesk_plus_mspMatch10.510501

zohocorpmanageengine_servicedesk_plus_mspMatch10.510502

zohocorpmanageengine_servicedesk_plus_mspMatch10.510503

zohocorpmanageengine_servicedesk_plus_mspMatch10.510504

zohocorpmanageengine_servicedesk_plus_mspMatch10.510505

zohocorpmanageengine_servicedesk_plus_mspMatch10.510506

zohocorpmanageengine_servicedesk_plus_mspMatch10.510507

zohocorpmanageengine_servicedesk_plus_mspMatch10.510508

zohocorpmanageengine_servicedesk_plus_mspMatch10.510509

zohocorpmanageengine_servicedesk_plus_mspMatch10.510510

zohocorpmanageengine_servicedesk_plus_mspMatch10.510511

zohocorpmanageengine_servicedesk_plus_mspMatch10.510512

zohocorpmanageengine_servicedesk_plus_mspMatch10.510513

zohocorpmanageengine_servicedesk_plus_mspMatch10.510514

zohocorpmanageengine_servicedesk_plus_mspMatch10.510515

zohocorpmanageengine_servicedesk_plus_mspMatch10.510516

zohocorpmanageengine_servicedesk_plus_mspMatch10.510517

zohocorpmanageengine_servicedesk_plus_mspMatch10.510518

zohocorpmanageengine_servicedesk_plus_mspMatch10.510519

zohocorpmanageengine_servicedesk_plus_mspMatch10.510520

zohocorpmanageengine_servicedesk_plus_mspMatch10.510521

zohocorpmanageengine_servicedesk_plus_mspMatch10.510522

zohocorpmanageengine_servicedesk_plus_mspMatch10.510523

zohocorpmanageengine_servicedesk_plus_mspMatch10.510524

zohocorpmanageengine_servicedesk_plus_mspMatch10.510525

zohocorpmanageengine_servicedesk_plus_mspMatch10.510526

zohocorpmanageengine_servicedesk_plus_mspMatch10.510527

zohocorpmanageengine_servicedesk_plus_mspMatch10.510528

zohocorpmanageengine_servicedesk_plus_mspMatch10.510529

zohocorpmanageengine_supportcenter_plusRange≤11.0

zohocorpmanageengine_supportcenter_plusMatch11.011000

zohocorpmanageengine_supportcenter_plusMatch11.011001

zohocorpmanageengine_supportcenter_plusMatch11.011002

zohocorpmanageengine_supportcenter_plusMatch11.011003

zohocorpmanageengine_supportcenter_plusMatch11.011004

zohocorpmanageengine_supportcenter_plusMatch11.011005

zohocorpmanageengine_supportcenter_plusMatch11.011006

zohocorpmanageengine_supportcenter_plusMatch11.011007

zohocorpmanageengine_supportcenter_plusMatch11.011008

zohocorpmanageengine_supportcenter_plusMatch11.011009

zohocorpmanageengine_supportcenter_plusMatch11.011010

zohocorpmanageengine_supportcenter_plusMatch11.011011

zohocorpmanageengine_supportcenter_plusMatch11.011012

zohocorpmanageengine_supportcenter_plusMatch11.011013

VendorProductVersionCPE
zohocorpmanageengine_servicedesk_plus11.1cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11138:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus11.1cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11139:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus11.1cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11140:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus11.1cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11141:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus11.1cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11142:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus11.1cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11143:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus11.1cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11144:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus11.1cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11145:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus11.2cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11200:*:*:*:*:*:*
zohocorpmanageengine_servicedesk_plus11.2cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11201:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_servicedesk_plus	11.1	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11138::::::
zohocorp	manageengine_servicedesk_plus	11.1	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11139::::::
zohocorp	manageengine_servicedesk_plus	11.1	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11140::::::
zohocorp	manageengine_servicedesk_plus	11.1	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11141::::::
zohocorp	manageengine_servicedesk_plus	11.1	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11142::::::
zohocorp	manageengine_servicedesk_plus	11.1	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11143::::::
zohocorp	manageengine_servicedesk_plus	11.1	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11144::::::
zohocorp	manageengine_servicedesk_plus	11.1	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11145::::::
zohocorp	manageengine_servicedesk_plus	11.2	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11200::::::
zohocorp	manageengine_servicedesk_plus	11.2	cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.2:11201::::::

Rows per page:

1-10 of 721

References

packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html

pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above

pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-msp-versions-10527-till-10529

pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021

pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-supportcenter-plus-versions-11012-and-11013