CVE-2021-44077

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 93,3%

Kerentanan Missing Authentication for Critical Function pada zohocorp manageengine servicedesk plus, zohocorp manageengine servicedesk plus msp +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 1 Desember 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.

Rincian

Terbit di NVD

29 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

93,3% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

Masuk KEV

1 Desember 2021

Tenggat CISA

15 Desember 2021 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 73 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerabili... patch · advisory vendor
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticate... advisory vendor
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticate... advisory vendor
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticate... advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44077 pemerintah AS
• http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry