PT-2022-12194 · Zoho · Zoho Manageengine M365 Manager Plus

Sahil Dhar · Published 2022-01-12 · Updated 2022-01-25 · CVE-2021-44652

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine O365 Manager Plus versions prior to Build 4416

Description The issue allows remote code execution via BCP file overwrite through the ChangeDBAPI component.

Recommendations For versions prior to Build 4416, update to Build 4416 or later to resolve the issue. As a temporary workaround, consider restricting access to the ChangeDBAPI component to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-44652

Affected Products

Zoho Manageengine M365 Manager Plus

References · 4

• https://osv.dev/vulnerability/CVE-2021-44652 · Vendor Advisory
• https://manageengine.com/microsoft-365-management-reporting/release-notes.html?Build=4416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44652 · Security Note
• https://t.me/cibsecurity/35337 · Telegram Post