CVE-2021-37415: Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability

Published Sep 1, 2021
·
Updated

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.

Affected Software

66 affected components
Zoho ManageEngine ServiceDesk Plus (SDP)
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11005
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11006
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11007
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11008
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11009
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11010
ZohoCorp ManageEngine ServiceDesk Plus=11.0-11011
ZohoCorp ManageEngine ServiceDesk Plus=11.1
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11100
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11101
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11102
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11103
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11104
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11105
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11106
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11107
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11108
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11109
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11110
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11111
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11112
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11113
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11114
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11115
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11116
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11117
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11118
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11119
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11120
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11121
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11122
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11123
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11124
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11125
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11126
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11127
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11128
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11129
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11130
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11131
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11132
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11133
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11134
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11135
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11136
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11137
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11138
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11139
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11140
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11141
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11142
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11143
ZohoCorp ManageEngine ServiceDesk Plus=11.1-11144
ZohoCorp ManageEngine ServiceDesk Plus=11.2
ZohoCorp ManageEngine ServiceDesk Plus=11.2-11200
ZohoCorp ManageEngine ServiceDesk Plus=11.2-11201
ZohoCorp ManageEngine ServiceDesk Plus=11.2-11202
ZohoCorp ManageEngine ServiceDesk Plus=11.2-11203
ZohoCorp ManageEngine ServiceDesk Plus=11.2-11204
ZohoCorp ManageEngine ServiceDesk Plus=11.2-11205
ZohoCorp ManageEngine ServiceDesk Plus=11.2-11206
ZohoCorp ManageEngine ServiceDesk Plus=11.2-11207
ZohoCorp ManageEngine ServiceDesk Plus=11.3
ZohoCorp ManageEngine ServiceDesk Plus=11.3-11300
ZohoCorp ManageEngine ServiceDesk Plus=11.3-11301

Event History

Sep 1, 2021
CVE Published
via MITRE·05:29 AM
Data Sourced
via MITRE·05:29 AM
Description
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Dec 1, 2021
Known Exploited
via CISA·12:00 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2021-37415?

The severity of CVE-2021-37415 is categorized as high due to the potential for authentication bypass.

2

How do I fix CVE-2021-37415?

To fix CVE-2021-37415, upgrade Zoho ManageEngine ServiceDesk Plus to version 11302 or later.

3

What are the potential impacts of CVE-2021-37415?

CVE-2021-37415 can lead to unauthorized access allowing attackers to execute REST API calls without proper authentication.

4

Which versions of Zoho ManageEngine ServiceDesk Plus are affected by CVE-2021-37415?

CVE-2021-37415 affects all versions of Zoho ManageEngine ServiceDesk Plus before 11302.

5

Is CVE-2021-37415 actively exploited?

As of the latest information available, there are reports of CVE-2021-37415 being actively exploited in the wild.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203