PT-2021-17328 · Zoho · Zoho Manageengine Adselfservice Plus

Published 2021-02-19 · Updated 2022-07-12 · CVE-2021-27214

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions through 6013

Description: A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet allows a remote unauthenticated attacker to perform blind HTTP requests or conduct a Cross-site scripting (XSS) attack against the administrative interface via an HTTP request.

Recommendations: For versions through 6013, consider restricting access to the ProductConfig servlet to minimize the risk of exploitation. As a temporary workaround, limit the ability to perform HTTP requests from the administrative interface until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

XSS

Weakness Enumeration

CWE-918

CWE-79

Related Identifiers

CVE-2021-27214

Affected Products

Zoho Manageengine Adselfservice Plus

References · 6

• 🔥 https://horizonsecurity.it/lang_EN/advisories/?a=20&title=ManageEngine+ADSelfService+Plus+privilege+escalation++CVE202127214 · Exploit
• https://osv.dev/vulnerability/CVE-2021-27214 · Vendor Advisory
• https://manageengine.com/products/self-service-password/release-notes.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27214 · Security Note
• https://t.me/cibsecurity/23886 · Telegram Post
• https://t.me/cvenotify/10178 · Telegram Post