PT-2022-12193 · Zoho · Zoho Manageengine Cloud Security Plus

Published 2022-01-12 · Updated 2022-01-24 · CVE-2021-44651

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine CloudSecurityPlus versions prior to Build 4117

Description The issue allows remote code execution through the updatePersonalizeSettings component due to an improper security patch.

Recommendations For versions prior to Build 4117, update to Build 4117 or later to resolve the issue. As a temporary workaround, consider restricting access to the updatePersonalizeSettings component until a patch is applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-44651

Affected Products

Zoho Manageengine Cloud Security Plus

References · 4

• https://osv.dev/vulnerability/CVE-2021-44651 · Vendor Advisory
• https://sahildhar.github.io/blogpost/Zoho-ManageEngine-CloudSecurityPlus-Remote-Code-Execution-via-Security-Misconfiguration · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44651 · Security Note
• https://t.me/cibsecurity/35336 · Telegram Post