CVE-2021-40539

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
VendorProductVersion
zohocorpmanageengine_adselfservice_plus
4.5:4510
zohocorpmanageengine_adselfservice_plus
4.5:4511
zohocorpmanageengine_adselfservice_plus
4.5:4520
zohocorpmanageengine_adselfservice_plus
4.5:4522
zohocorpmanageengine_adselfservice_plus
4.5:4531
zohocorpmanageengine_adselfservice_plus
4.5:4540
zohocorpmanageengine_adselfservice_plus
4.5:4543
zohocorpmanageengine_adselfservice_plus
4.5:4544
zohocorpmanageengine_adselfservice_plus
4.5:4550
zohocorpmanageengine_adselfservice_plus
4.5:4560
zohocorpmanageengine_adselfservice_plus
4.5:4570
zohocorpmanageengine_adselfservice_plus
4.5:4571
zohocorpmanageengine_adselfservice_plus
4.5:4572
zohocorpmanageengine_adselfservice_plus
4.5:4580
zohocorpmanageengine_adselfservice_plus
4.5:4590
zohocorpmanageengine_adselfservice_plus
4.5:4591
zohocorpmanageengine_adselfservice_plus
4.5:4592
zohocorpmanageengine_adselfservice_plus
5.0:5000
zohocorpmanageengine_adselfservice_plus
5.0:5001
zohocorpmanageengine_adselfservice_plus
5.0:5002
zohocorpmanageengine_adselfservice_plus
5.0:5010
zohocorpmanageengine_adselfservice_plus
5.0:5011
zohocorpmanageengine_adselfservice_plus
5.0:5020
zohocorpmanageengine_adselfservice_plus
5.0:5021
zohocorpmanageengine_adselfservice_plus
5.0:5022
zohocorpmanageengine_adselfservice_plus
5.0:5030
zohocorpmanageengine_adselfservice_plus
5.0:5032
zohocorpmanageengine_adselfservice_plus
5.0:5040
zohocorpmanageengine_adselfservice_plus
5.0:5041
zohocorpmanageengine_adselfservice_plus
5.0.6
zohocorpmanageengine_adselfservice_plus
5.1:5100
zohocorpmanageengine_adselfservice_plus
5.1:5101
zohocorpmanageengine_adselfservice_plus
5.1:5102
zohocorpmanageengine_adselfservice_plus
5.1:5103
zohocorpmanageengine_adselfservice_plus
5.1:5104
zohocorpmanageengine_adselfservice_plus
5.1:5105
zohocorpmanageengine_adselfservice_plus
5.1:5106
zohocorpmanageengine_adselfservice_plus
5.1:5107
zohocorpmanageengine_adselfservice_plus
5.1:5108
zohocorpmanageengine_adselfservice_plus
5.1:5109
zohocorpmanageengine_adselfservice_plus
5.1:5110
zohocorpmanageengine_adselfservice_plus
5.1:5111
zohocorpmanageengine_adselfservice_plus
5.1:5112
zohocorpmanageengine_adselfservice_plus
5.1:5113
zohocorpmanageengine_adselfservice_plus
5.1:5114
zohocorpmanageengine_adselfservice_plus
5.1:5115
zohocorpmanageengine_adselfservice_plus
5.1:5116
zohocorpmanageengine_adselfservice_plus
5.2:5200
zohocorpmanageengine_adselfservice_plus
5.2:5201
zohocorpmanageengine_adselfservice_plus
5.2:5202
zohocorpmanageengine_adselfservice_plus
5.2:5203
zohocorpmanageengine_adselfservice_plus
5.2:5204
zohocorpmanageengine_adselfservice_plus
5.2:5205
zohocorpmanageengine_adselfservice_plus
5.2:5206
zohocorpmanageengine_adselfservice_plus
5.2:5207
zohocorpmanageengine_adselfservice_plus
5.3:5300
zohocorpmanageengine_adselfservice_plus
5.3:5301
zohocorpmanageengine_adselfservice_plus
5.3:5302
zohocorpmanageengine_adselfservice_plus
5.3:5303
zohocorpmanageengine_adselfservice_plus
5.3:5304
zohocorpmanageengine_adselfservice_plus
5.3:5305
zohocorpmanageengine_adselfservice_plus
5.3:5306
zohocorpmanageengine_adselfservice_plus
5.3:5307
zohocorpmanageengine_adselfservice_plus
5.3:5308
zohocorpmanageengine_adselfservice_plus
5.3:5309
zohocorpmanageengine_adselfservice_plus
5.3:5310
zohocorpmanageengine_adselfservice_plus
5.3:5311
zohocorpmanageengine_adselfservice_plus
5.3:5312
zohocorpmanageengine_adselfservice_plus
5.3:5313
zohocorpmanageengine_adselfservice_plus
5.3:5314
zohocorpmanageengine_adselfservice_plus
5.3:5315
zohocorpmanageengine_adselfservice_plus
5.3:5316
zohocorpmanageengine_adselfservice_plus
5.3:5317
zohocorpmanageengine_adselfservice_plus
5.3:5318
zohocorpmanageengine_adselfservice_plus
5.3:5319
zohocorpmanageengine_adselfservice_plus
5.3:5320
zohocorpmanageengine_adselfservice_plus
5.3:5321
zohocorpmanageengine_adselfservice_plus
5.3:5322
zohocorpmanageengine_adselfservice_plus
5.3:5323
zohocorpmanageengine_adselfservice_plus
5.3:5324
zohocorpmanageengine_adselfservice_plus
5.3:5325
zohocorpmanageengine_adselfservice_plus
5.3:5326
zohocorpmanageengine_adselfservice_plus
5.3:5327
zohocorpmanageengine_adselfservice_plus
5.3:5328
zohocorpmanageengine_adselfservice_plus
5.3:5329
zohocorpmanageengine_adselfservice_plus
5.3:5330
zohocorpmanageengine_adselfservice_plus
5.4:5400
zohocorpmanageengine_adselfservice_plus
5.5
zohocorpmanageengine_adselfservice_plus
5.5:5500
zohocorpmanageengine_adselfservice_plus
5.5:5501
zohocorpmanageengine_adselfservice_plus
5.5:5502
zohocorpmanageengine_adselfservice_plus
5.5:5503
zohocorpmanageengine_adselfservice_plus
5.5:5504
zohocorpmanageengine_adselfservice_plus
5.5:5505
zohocorpmanageengine_adselfservice_plus
5.5:5506
zohocorpmanageengine_adselfservice_plus
5.5:5507
zohocorpmanageengine_adselfservice_plus
5.5:5508
zohocorpmanageengine_adselfservice_plus
5.5:5509
zohocorpmanageengine_adselfservice_plus
5.5:5510
zohocorpmanageengine_adselfservice_plus
5.5:5511
zohocorpmanageengine_adselfservice_plus
5.5:5512
zohocorpmanageengine_adselfservice_plus
5.5:5513
zohocorpmanageengine_adselfservice_plus
5.5:5514
zohocorpmanageengine_adselfservice_plus
5.5:5515
zohocorpmanageengine_adselfservice_plus
5.5:5516
zohocorpmanageengine_adselfservice_plus
5.5:5517
zohocorpmanageengine_adselfservice_plus
5.5:5518
zohocorpmanageengine_adselfservice_plus
5.5:5519
zohocorpmanageengine_adselfservice_plus
5.5:5520
zohocorpmanageengine_adselfservice_plus
5.5:5521
zohocorpmanageengine_adselfservice_plus
5.6:5600
zohocorpmanageengine_adselfservice_plus
5.6:5601
zohocorpmanageengine_adselfservice_plus
5.6:5602
zohocorpmanageengine_adselfservice_plus
5.6:5603
zohocorpmanageengine_adselfservice_plus
5.6:5604
zohocorpmanageengine_adselfservice_plus
5.6:5605
zohocorpmanageengine_adselfservice_plus
5.6:5606
zohocorpmanageengine_adselfservice_plus
5.6:5607
zohocorpmanageengine_adselfservice_plus
5.7:5607
zohocorpmanageengine_adselfservice_plus
5.7:5700
zohocorpmanageengine_adselfservice_plus
5.7:5701
zohocorpmanageengine_adselfservice_plus
5.7:5702
zohocorpmanageengine_adselfservice_plus
5.7:5703
zohocorpmanageengine_adselfservice_plus
5.7:5704
zohocorpmanageengine_adselfservice_plus
5.7:5705
zohocorpmanageengine_adselfservice_plus
5.7:5706
zohocorpmanageengine_adselfservice_plus
5.7:5707
zohocorpmanageengine_adselfservice_plus
5.7:5708
zohocorpmanageengine_adselfservice_plus
5.7:5709
zohocorpmanageengine_adselfservice_plus
5.7:5710
zohocorpmanageengine_adselfservice_plus
5.8
zohocorpmanageengine_adselfservice_plus
5.8:5800
zohocorpmanageengine_adselfservice_plus
5.8:5801
zohocorpmanageengine_adselfservice_plus
5.8:5802
zohocorpmanageengine_adselfservice_plus
5.8:5803
zohocorpmanageengine_adselfservice_plus
5.8:5804
zohocorpmanageengine_adselfservice_plus
5.8:5805
zohocorpmanageengine_adselfservice_plus
5.8:5806
zohocorpmanageengine_adselfservice_plus
5.8:5807
zohocorpmanageengine_adselfservice_plus
5.8:5808
zohocorpmanageengine_adselfservice_plus
5.8:5809
zohocorpmanageengine_adselfservice_plus
5.8:5810
zohocorpmanageengine_adselfservice_plus
5.8:5811
zohocorpmanageengine_adselfservice_plus
5.8:5812
zohocorpmanageengine_adselfservice_plus
5.8:5813
zohocorpmanageengine_adselfservice_plus
5.8:5814
zohocorpmanageengine_adselfservice_plus
5.8:5815
zohocorpmanageengine_adselfservice_plus
5.8:5816
zohocorpmanageengine_adselfservice_plus
6.0
zohocorpmanageengine_adselfservice_plus
6.0:6000
zohocorpmanageengine_adselfservice_plus
6.0:6001
zohocorpmanageengine_adselfservice_plus
6.0:6002
zohocorpmanageengine_adselfservice_plus
6.0:6003
zohocorpmanageengine_adselfservice_plus
6.0:6004
zohocorpmanageengine_adselfservice_plus
6.0:6005
zohocorpmanageengine_adselfservice_plus
6.0:6006
zohocorpmanageengine_adselfservice_plus
6.0:6007
zohocorpmanageengine_adselfservice_plus
6.0:6008
zohocorpmanageengine_adselfservice_plus
6.0:6009
zohocorpmanageengine_adselfservice_plus
6.0:6012
zohocorpmanageengine_adselfservice_plus
6.0:6013
zohocorpmanageengine_adselfservice_plus
6.1
zohocorpmanageengine_adselfservice_plus
6.1:6100
zohocorpmanageengine_adselfservice_plus
6.1:6101
zohocorpmanageengine_adselfservice_plus
6.1:6102
zohocorpmanageengine_adselfservice_plus
6.1:6103
zohocorpmanageengine_adselfservice_plus
6.1:6104
zohocorpmanageengine_adselfservice_plus
6.1:6105
zohocorpmanageengine_adselfservice_plus
6.1:6106
zohocorpmanageengine_adselfservice_plus
6.1:6113
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html
https://www.manageengine.com
https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html
https://www.manageengine.com
https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html