PT-2021-21698 · Zoho · Zoho Manageengine Admanager Plus

Bmtd · Published 2021-09-27 · Updated 2021-10-01 · CVE-2021-37539

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADManager Plus versions prior to 7111

Description The issue is related to an unrestricted file upload, which can lead to remote code execution.

Recommendations For versions prior to 7111, update to version 7111 or later to resolve the issue. As a temporary workaround, consider restricting access to file upload functionality to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-37539

Affected Products

Zoho Manageengine Admanager Plus

References · 6

• https://osv.dev/vulnerability/CVE-2021-37539 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37539 · Security Note
• https://manageengine.com/products/ad-manager/release-notes.html#7111 · Vendor Advisory
• https://manageengine.com · Note
• https://t.me/cibsecurity/29486 · Telegram Post
• https://t.me/cvenotify/21519 · Telegram Post