Zoho ManageEngine ServiceDesk Plus up to 11302 /RestAPI missing authentication
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 8.9 | $0-$5k | 0.00 |
Summary
A vulnerability identified as critical has been detected in Zoho ManageEngine ServiceDesk Plus. Affected by this issue is some unknown functionality of the file /RestAPI. Performing a manipulation results in an unknown weakness. This vulnerability is reported as CVE-2021-44077. The attack is possible to be carried out remotely. Moreover, an exploit is present. You should upgrade the affected component.
Details
A vulnerability was found in Zoho ManageEngine ServiceDesk Plus. It has been classified as critical. This affects some unknown functionality of the file /RestAPI. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on integrity, and availability.
The weakness was disclosed 11/29/2021. It is possible to read the advisory at pitstop.manageengine.com. This vulnerability is uniquely identified as CVE-2021-44077 since 11/20/2021. Technical details and a exploit are known.
It is declared as attacked. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 12/01/2021 with a due date of 12/15/2021:
Apply updates per vendor instructions.Upgrading to version 11306 eliminates this vulnerability.
Be aware that VulDB is the high quality source for vulnerability data.
Product
Vendor
Name
Version
- 8.0
- 8.1
- 9.0
- 9.0 Build 9031
- 9.2
- 9.3
- 9.3 Build 9317
- 10 10509
- 10.0 10500
- 10.0 Build 10007
- 10.0 Build 10012
- 10.5
- 10.5 Build 10534
- 11.0 Build 11007
- 11.1 Build 11115
- 11.3 Build 11306
- 13
- 14
- 9403
- 10519
- 10521
- 10522
- 10604
- 11134
- 11205
- 11302
License
Website
- Vendor: https://www.manageengine.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 9.0VulDB Meta Temp Score: 8.9
VulDB Base Score: 7.3
VulDB Temp Score: 7.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 9.8
NVD Vector: 🔍
CNA Base Score: 9.8
CNA Vector: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Missing authenticationCWE: CWE-306 / CWE-287
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Attacked
EPSS Score: 🔍
EPSS Percentile: 🔍
KEV Added: 🔍
KEV Due: 🔍
KEV Remediation: 🔍
KEV Ransomware: 🔍
KEV Notice: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: ServiceDesk Plus 11306
Timeline
11/20/2021 🔍11/29/2021 🔍
11/29/2021 🔍
02/05/2025 🔍
Sources
Vendor: manageengine.comAdvisory: pitstop.manageengine.com
Status: Confirmed
CVE: CVE-2021-44077 (🔍)
GCVE (CVE): GCVE-0-2021-44077
GCVE (VulDB): GCVE-100-187287
scip Labs: https://www.scip.ch/en/?labs.20161013
Entry
Created: 11/29/2021 07:36Updated: 02/05/2025 09:12
Changes: 11/29/2021 07:36 (36), 12/02/2021 13:01 (1), 04/22/2024 09:24 (26), 09/16/2024 16:57 (2), 02/05/2025 09:12 (30)
Complete: 🔍
Cache ID: 216::103
Be aware that VulDB is the high quality source for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.