Unauthenticated Remote Code Execution Vulnerability in Zoho ManageEngine ServiceDesk Plus MSP
CVE-2021-44675

9.8CRITICAL

Key Information:

Vendor

Zohocorp
Status
Manageengine Servicedesk Plus Msp
Vendor
CVE Published:
20 December 2021

What is CVE-2021-44675?

Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10.5 Build 10534 are susceptible to a serious security flaw. This vulnerability allows attackers to exploit a filter bypass, leading to the potential for unauthenticated remote code execution. As a result, attackers could execute arbitrary code without needing authentication, posing a significant risk to systems utilizing this software. It's crucial for users to update to the latest version to mitigate this vulnerability.

References

https://pitstop.manageengine.com/portal/en/community/topi...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2021-44675 : Unauthenticated Remote Code Execution Vulnerability in Zoho ManageEngine ServiceDesk Plus MSP