Actively exploited in the wild
Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
Zoho - ManageEngine ServiceDesk Plus (SDP) · Listed in the CISA KEV since 2021-12-01. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-37415
CriticalCVSS 9.8KEVSummary
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.
Risk Assessment
An unauthorized user can access sensitive API functions, potentially leading to data leakage or unauthorized changes in the system.
Recommendation
Update ServiceDesk Plus to version 11302 or later to eliminate this vulnerability.
Other vulnerabilities in Zoho ManageEngine ServiceDesk Plus
See all- CVE-2016-4889High
ZOHO ManageEngine ServiceDesk Plus before 9.0 allows remote authenticated guest users to leverage failure to restrict access to unknown functions, potentially leading to unspecified impact.
- CVE-2021-44077CriticalActively exploited
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
Original NVD description (English source)
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.