CVE-2021-44651

Published: Jan 12, 2022Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security patch for CVE-2021-40175.

Affected (10)

Products: Zohocorp: Manageengine Cloud Security Plus, Log360

Zohocorp

2 products

Manageengine Cloud Security Plus

Log360

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Cloud Security Plus	Before 4.1
Zohocorp Manageengine Cloud Security Plus	Version 4.1
Zohocorp Manageengine Cloud Security Plus	Version 4.1 build4110
Zohocorp Manageengine Cloud Security Plus	Version 4.1 build4111
Zohocorp Manageengine Cloud Security Plus	Version 4.1 build4112
Zohocorp Manageengine Cloud Security Plus	Version 4.1 build4113
Zohocorp Manageengine Cloud Security Plus	Version 4.1 build4115
Zohocorp Manageengine Cloud Security Plus	Version 4.1 build4116

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Log360	Up to 5.2.2
Zohocorp Manageengine Cloud Security Plus	Up to 4.1.1.7

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (2)

https://sahildhar.github.io/blogpost/Zoho-ManageEngine-CloudSecurityPlus-Remote-Code-Execution-via-Security-Misconfiguration/

Source: cve@mitre.org

Vendor Advisory

https://sahildhar.github.io/blogpost/Zoho-ManageEngine-CloudSecurityPlus-Remote-Code-Execution-via-Security-Misconfiguration/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.