Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction None
No CVSS v3.0
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is in the KEV database since Nov. 3, 2021.
Exploitation active
Automatable yes
Technical Impact total
Affected Vendors & Products
Vendors | Products |
---|---|
Zohocorp |
|
Configuration 1 [-]
|
No data.
References
History
Mon, 03 Feb 2025 16:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
kev
|

Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2025-02-03T15:46:32.217Z
Reserved: 2021-09-06T00:00:00.000Z
Link: CVE-2021-40539

Updated: 2024-08-04T02:44:10.872Z

Status : Modified
Published: 2021-09-07T17:15:07.367
Modified: 2025-02-03T16:15:31.417
Link: CVE-2021-40539

No data.