PT-2021-21646 · Zoho · Zoho Manageengine Adselfservice Plus

Published 2021-09-10 · Updated 2021-09-17 · CVE-2021-37422

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 6111 and prior

Description The issue is related to SQL Injection that occurs while linking databases.

Recommendations For versions 6111 and prior, update to a version later than 6111 to resolve the SQL Injection issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-37422

Affected Products

Zoho Manageengine Adselfservice Plus

References · 4

• https://osv.dev/vulnerability/CVE-2021-37422 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37422 · Security Note
• https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release · Vendor Advisory
• https://t.me/cibsecurity/28688 · Telegram Post