← Back

CVE-2021-40539

nvd nistnuclei
Published: Sep 7, 2021Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

Affected (10)

Zohocorp
1 product
Manageengine Adselfservice Plus
Configuration A
10 vulnerable
Vulnerable SoftwareAffected Versions
Zohocorp
Manageengine Adselfservice Plus
Before 6.1
Manageengine Adselfservice Plus
Version 6.1
Manageengine Adselfservice Plus
Version 6.1 6100
Manageengine Adselfservice Plus
Version 6.1 6101
Manageengine Adselfservice Plus
Version 6.1 6102
Manageengine Adselfservice Plus
Version 6.1 6103
Manageengine Adselfservice Plus
Version 6.1 6104
Manageengine Adselfservice Plus
Version 6.1 6105
Manageengine Adselfservice Plus
Version 6.1 6106
Manageengine Adselfservice Plus
Version 6.1 6113

Related CWEs

CWE-706
Use of Incorrectly-Resolved Name or Reference
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

References (7)

Source: cve@mitre.org
ExploitThird Party AdvisoryVDB Entry
Source: cve@mitre.org
Product
Source: cve@mitre.org
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Product
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.