CVE-2021-31159: Medium severity zohocorp manageengine servicedesk plus msp vulnerability

Published Jun 16, 2021
·
Updated

Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.

Affected Software

112 affected components
ZohoCorp ManageEngine ServiceDesk Plus MSP>=8.0<=9.4
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10500
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10501
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10502
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10503
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10504
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10505
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10506
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10507
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10508
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10509
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10510
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10511
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10512
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10513
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10514
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10515
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10516
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10517
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10518
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8000
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8001
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8002
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8003
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8004
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8100
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8101
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8102
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8103
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8104
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8105
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8200
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8201
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8202
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8203
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8204
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8205
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8206
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8207
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8208
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8209
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8210
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8211
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8300
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8301
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8302
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8303
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8304
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8305
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8306
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8307
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8308
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8309
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8310
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8311
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-8312
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9000
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9001
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9002
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9003
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9004
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9005
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9006
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9007
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9008
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9009
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9201
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9203
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9204
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9205
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9206
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9207
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9208
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9209
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9210
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9300
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9301
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9302
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9303
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9304
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9305
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9306
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9307
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9308
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9400
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9401
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9402
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9403
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9404
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9405
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9406
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9407
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9408
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9409
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9410
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9411
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9412
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9413
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9414
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9415
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9416
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9417
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9418
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9419
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9420
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9421
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9422
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9423
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9424
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9425
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9426
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-9427

Event History

Jun 16, 2021
CVE Published
via MITRE·12:51 PM
Data Sourced
via MITRE·12:51 PM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2021-31159?

CVE-2021-31159 has been classified as a low severity vulnerability as it allows for user enumeration through improper error-message generation.

2

How do I fix CVE-2021-31159?

To remediate CVE-2021-31159, it is recommended to upgrade Zoho ManageEngine ServiceDesk Plus MSP to version 10.5-10519 or later.

3

Which versions of Zoho ManageEngine ServiceDesk Plus MSP are affected by CVE-2021-31159?

CVE-2021-31159 affects Zoho ManageEngine ServiceDesk Plus MSP versions prior to 10.5-10519, including versions 9.4 and earlier.

4

What impact does CVE-2021-31159 have on users?

CVE-2021-31159 potentially exposes user account information by allowing attackers to determine if specific usernames are registered.

5

Is there a public exploit available for CVE-2021-31159?

Currently, there are no known public exploits for CVE-2021-31159, but the vulnerability can still be exploited through the user enumeration method.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203