PT-2021-21644 · Manageengine · Zoho Manageengine Adselfservice Plus

Krzysztof Andrusiak + 1 · Published 2021-09-21 · Updated 2022-07-12 · CVE-2021-37420

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to 6112

Description The issue allows for mail spoofing.

Recommendations For versions prior to 6112, update to version 6112 or later to resolve the issue.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-37420

Affected Products

Zoho Manageengine Adselfservice Plus

References · 6

• 🔥 https://blog.stmcyber.com/vulns/cve-2021-37420 · Exploit
• https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37420 · Vendor Advisory
• https://manageengine.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37420 · Security Note
• https://t.me/cibsecurity/29180 · Telegram Post