PT-2021-7237 · Zoho · Zoho Manageengine Servicedesk Plus

Published 2021-09-01 · Updated 2025-12-10 · CVE-2021-37415

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ServiceDesk Plus versions prior to 11302

Description The issue is related to the implementation of the REST API interface in Zoho ManageEngine ServiceDesk Plus, specifically concerning weaknesses in the authentication procedure. This can be exploited by a remote attacker to bypass existing security restrictions, allowing access to certain REST-API URLs without proper authentication.

Recommendations For versions prior to 11302, update to version 11302 or later to resolve the authentication bypass issue. As a temporary workaround, consider restricting access to the REST API endpoints that do not require authentication until a patch is applied.

Fix

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

BDU:2022-04032

CVE-2021-37415

Affected Products

Zoho Manageengine Servicedesk Plus

References · 13

• https://osv.dev/vulnerability/CVE-2021-37415 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04032 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-37415 · Security Note
• https://t.me/cvenotify/109676 · Telegram Post
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://t.me/cibsecurity/28145 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/1998709308515836348 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-37415 · Note
• https://t.me/cvenotify/71418 · Telegram Post
• https://t.me/cvenotify/20492 · Telegram Post
• https://t.me/cveNotify/141168 · Telegram Post
• https://manageengine.com/products/service-desk/on-premises/readme.html#11302 · Note
• https://manageengine.com · Note