CVE-2021-31159

Katalog CVE

CVSS 5.3 · Medium EPSS 17,8%

Kerentanan Generation of Error Message Containing Sensitive Information pada zohocorp manageengine servicedesk plus msp. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.

Rincian

Terbit di NVD

16 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

17,8% peluang dieksploitasi; lebih tinggi dari 97,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 112 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://www.manageengine.com/products/service-desk-msp/readme.html#10519 release notes · advisory vendor
• http://packetstormsecurity.com/files/163192/Zoho-ManageEngine-ServiceDesk-Plus-9.4-User-Enumeration.html exploit · advisory pihak ketiga · vdb entry
• https://github.com/ricardojoserf/CVE-2021-31159 exploit · advisory pihak ketiga
• https://www.manageengine.com product