9.8

CVE-2021-44077

Warnung
Exploit
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.1 Update 11138
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.1 Update 11139
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.1 Update 11140
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.1 Update 11141
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.1 Update 11142
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.1 Update 11143
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.1 Update 11144
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.1 Update 11145
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.2 Update 11200
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.2 Update 11201
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.2 Update 11202
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.2 Update 11203
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.2 Update 11204
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.2 Update 11205
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.2 Update 11206
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.2 Update 11207
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.2 Update 11208
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.2 Update 11209
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.2 Update 11210
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.2 Update 11211
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.3 Update 11300
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.3 Update 11301
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.3 Update 11302
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.3 Update 11303
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.3 Update 11304
Zohocorp ≫ Manageengine Servicedesk Plus Version 11.3 Update 11305
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10500
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10501
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10502
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10503
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10504
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10505
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10506
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10507
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10508
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10509
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10510
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10511
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10512
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10513
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10514
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10515
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10516
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10517
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10518
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10519
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10520
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10521
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10522
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10523
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10524
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10525
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10526
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10527
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10528
Zohocorp ≫ Manageengine Servicedesk Plus Msp Version 10.5 Update 10529
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11000
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11001
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11002
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11003
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11004
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11005
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11006
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11007
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11008
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11009
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11010
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11011
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11012
Zohocorp ≫ Manageengine Supportcenter Plus Version 11.0 Update 11013

01.12.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

Schwachstelle

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 93.3% 0.998
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CISA-ADP 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html
Third Party Advisory
Exploit
VDB Entry
https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above
Patch
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-msp-versions-10527-till-10529
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021
Vendor Advisory
https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-supportcenter-plus-versions-11012-and-11013
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44077
US Government Resource