PT-2021-24145 · Zoho · Zoho Manageengine Access Manager Plus

Published 2021-12-20 · Updated 2023-08-08 · CVE-2021-44676

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Access Manager Plus versions prior to 4203

Description: The issue allows anyone to view certain data elements, such as access control details, and modify some aspects of the application state.

Recommendations: For versions prior to 4203, update to version 4203 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data elements and application state modification capabilities until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-44676

Affected Products

Zoho Manageengine Access Manager Plus

References · 5

• https://manageengine.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-44676 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44676 · Security Note
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-access-manager-plus-build-4202-and-prior · Vendor Advisory
• https://t.me/cibsecurity/34287 · Telegram Post