← Retour aux CVEs
CVE-2021-40539
CRITICALCISA KEV9.8
Description
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Details CVE
Score CVSS v3.19.8
SeveriteCRITICAL
Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vecteur d'attaqueNETWORK
ComplexiteLOW
Privileges requisNONE
Interaction utilisateurNONE
Publie9/7/2021
Derniere modification11/5/2025
Sourcekev
Observations honeypot0
CISA KEV
FournisseurZoho
ProduitManageEngine
Nom vulnerabiliteZoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
Date ajout KEV2021-11-03
Date limite remediation2021-11-17
Utilise dans ransomwareKnown
Produits affectes
zohocorp:manageengine_adselfservice_plus
Faiblesses (CWE)
CWE-706CWE-706
References
http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html(cve@mitre.org)
https://www.manageengine.com(cve@mitre.org)
https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html(cve@mitre.org)
http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.manageengine.com(af854a3a-2127-422b-91ae-364da2661108)
https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40539(134c704f-9b21-4f2e-91b3-4a467353bcc0)
Correlations IOC
Aucune correlation enregistree
This product uses data from the NVD API but is not endorsed or certified by the NVD.