CVE-2021-44077: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
First published: Mon Nov 29 2021(Updated: )
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| =11.1-11138 | ||
| =11.1-11139 | ||
| =11.1-11140 | ||
| =11.1-11141 | ||
| =11.1-11142 | ||
| =11.1-11143 | ||
| =11.1-11144 | ||
| =11.1-11145 | ||
| =11.2-11200 | ||
| =11.2-11201 | ||
| =11.2-11202 | ||
| =11.2-11203 | ||
| =11.2-11204 | ||
| =11.2-11205 | ||
| =11.2-11206 | ||
| =11.2-11207 | ||
| =11.2-11208 | ||
| =11.2-11209 | ||
| =11.2-11210 | ||
| =11.2-11211 | ||
| =11.3-11300 | ||
| =11.3-11301 | ||
| =11.3-11302 | ||
| =11.3-11303 | ||
| =11.3-11304 | ||
| =11.3-11305 | ||
| <=10.5 | ||
| =10.5-10500 | ||
| =10.5-10501 | ||
| =10.5-10502 | ||
| =10.5-10503 | ||
| =10.5-10504 | ||
| =10.5-10505 | ||
| =10.5-10506 | ||
| =10.5-10507 | ||
| =10.5-10508 | ||
| =10.5-10509 | ||
| =10.5-10510 | ||
| =10.5-10511 | ||
| =10.5-10512 | ||
| =10.5-10513 | ||
| =10.5-10514 | ||
| =10.5-10515 | ||
| =10.5-10516 | ||
| =10.5-10517 | ||
| =10.5-10518 | ||
| =10.5-10519 | ||
| =10.5-10520 | ||
| =10.5-10521 | ||
| =10.5-10522 | ||
| =10.5-10523 | ||
| =10.5-10524 | ||
| =10.5-10525 | ||
| =10.5-10526 | ||
| =10.5-10527 | ||
| =10.5-10528 | ||
| =10.5-10529 | ||
| <=11.0 | ||
| =11.0-11000 | ||
| =11.0-11001 | ||
| =11.0-11002 | ||
| =11.0-11003 | ||
| =11.0-11004 | ||
| =11.0-11005 | ||
| =11.0-11006 | ||
| =11.0-11007 | ||
| =11.0-11008 | ||
| =11.0-11009 | ||
| =11.0-11010 | ||
| =11.0-11011 | ||
| =11.0-11012 | ||
| =11.0-11013 | ||
| Zoho ManageEngine ServiceDesk Plus | ||
| ManageEngine ServiceDesk Plus | =11.1-11138 | |
| ManageEngine ServiceDesk Plus | =11.1-11139 | |
| ManageEngine ServiceDesk Plus | =11.1-11140 | |
| ManageEngine ServiceDesk Plus | =11.1-11141 | |
| ManageEngine ServiceDesk Plus | =11.1-11142 | |
| ManageEngine ServiceDesk Plus | =11.1-11143 | |
| ManageEngine ServiceDesk Plus | =11.1-11144 | |
| ManageEngine ServiceDesk Plus | =11.1-11145 | |
| ManageEngine ServiceDesk Plus | =11.2-11200 | |
| ManageEngine ServiceDesk Plus | =11.2-11201 | |
| ManageEngine ServiceDesk Plus | =11.2-11202 | |
| ManageEngine ServiceDesk Plus | =11.2-11203 | |
| ManageEngine ServiceDesk Plus | =11.2-11204 | |
| ManageEngine ServiceDesk Plus | =11.2-11205 | |
| ManageEngine ServiceDesk Plus | =11.2-11206 | |
| ManageEngine ServiceDesk Plus | =11.2-11207 | |
| ManageEngine ServiceDesk Plus | =11.2-11208 | |
| ManageEngine ServiceDesk Plus | =11.2-11209 | |
| ManageEngine ServiceDesk Plus | =11.2-11210 | |
| ManageEngine ServiceDesk Plus | =11.2-11211 | |
| ManageEngine ServiceDesk Plus | =11.3-11300 | |
| ManageEngine ServiceDesk Plus | =11.3-11301 | |
| ManageEngine ServiceDesk Plus | =11.3-11302 | |
| ManageEngine ServiceDesk Plus | =11.3-11303 | |
| ManageEngine ServiceDesk Plus | =11.3-11304 | |
| ManageEngine ServiceDesk Plus | =11.3-11305 | |
| ManageEngine ServiceDesk Plus MSP | <=10.5 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10500 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10501 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10502 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10503 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10504 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10505 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10506 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10507 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10508 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10509 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10510 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10511 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10512 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10513 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10514 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10515 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10516 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10517 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10518 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10519 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10520 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10521 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10522 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10523 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10524 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10525 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10526 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10527 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10528 | |
| ManageEngine ServiceDesk Plus MSP | =10.5-10529 | |
| ManageEngine SupportCenter Plus | <=11.0 | |
| ManageEngine SupportCenter Plus | =11.0-11000 | |
| ManageEngine SupportCenter Plus | =11.0-11001 | |
| ManageEngine SupportCenter Plus | =11.0-11002 | |
| ManageEngine SupportCenter Plus | =11.0-11003 | |
| ManageEngine SupportCenter Plus | =11.0-11004 | |
| ManageEngine SupportCenter Plus | =11.0-11005 | |
| ManageEngine SupportCenter Plus | =11.0-11006 | |
| ManageEngine SupportCenter Plus | =11.0-11007 | |
| ManageEngine SupportCenter Plus | =11.0-11008 | |
| ManageEngine SupportCenter Plus | =11.0-11009 | |
| ManageEngine SupportCenter Plus | =11.0-11010 | |
| ManageEngine SupportCenter Plus | =11.0-11011 | |
| ManageEngine SupportCenter Plus | =11.0-11012 | |
| ManageEngine SupportCenter Plus | =11.0-11013 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-msp-versions-10527-till-10529
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-supportcenter-plus-versions-11012-and-11013
- https://nvd.nist.gov/vuln/detail/CVE-2021-44077
Frequently Asked Questions
What is the severity of CVE-2021-44077?
CVE-2021-44077 is classified as a critical vulnerability due to its potential for unauthenticated remote code execution.
How do I fix CVE-2021-44077?
To mitigate CVE-2021-44077, update Zoho ManageEngine ServiceDesk Plus or SupportCenter Plus to the latest versions that have patched this vulnerability.
Which versions are affected by CVE-2021-44077?
CVE-2021-44077 affects multiple versions of Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus prior to their respective fixed versions.
What can attackers achieve with CVE-2021-44077?
Exploiting CVE-2021-44077 allows attackers to execute arbitrary code remotely without any authentication.
Is there a workaround for CVE-2021-44077 if I can’t update immediately?
Currently, the recommended mitigation for CVE-2021-44077 is to apply the vendor's patches as no reliable workaround has been provided.
- collector/nvd-index
- agent/type
- agent/title
- agent/severity
- agent/weakness
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- agent/references
- agent/author
- agent/source
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- collector/nvd-api
- vendor/zohocorp
- vendor/zoho
- canonical/zoho manageengine servicedesk plus
- canonical/manageengine servicedesk plus
- version/manageengine servicedesk plus/11.1-11138
- version/manageengine servicedesk plus/11.1-11139
- version/manageengine servicedesk plus/11.1-11140
- version/manageengine servicedesk plus/11.1-11141
- version/manageengine servicedesk plus/11.1-11142
- version/manageengine servicedesk plus/11.1-11143
- version/manageengine servicedesk plus/11.1-11144
- version/manageengine servicedesk plus/11.1-11145
- version/manageengine servicedesk plus/11.2-11200
- version/manageengine servicedesk plus/11.2-11201
- version/manageengine servicedesk plus/11.2-11202
- version/manageengine servicedesk plus/11.2-11203
- version/manageengine servicedesk plus/11.2-11204
- version/manageengine servicedesk plus/11.2-11205
- version/manageengine servicedesk plus/11.2-11206
- version/manageengine servicedesk plus/11.2-11207
- version/manageengine servicedesk plus/11.2-11208
- version/manageengine servicedesk plus/11.2-11209
- version/manageengine servicedesk plus/11.2-11210
- version/manageengine servicedesk plus/11.2-11211
- version/manageengine servicedesk plus/11.3-11300
- version/manageengine servicedesk plus/11.3-11301
- version/manageengine servicedesk plus/11.3-11302
- version/manageengine servicedesk plus/11.3-11303
- version/manageengine servicedesk plus/11.3-11304
- version/manageengine servicedesk plus/11.3-11305
- canonical/manageengine servicedesk plus msp
- version/manageengine servicedesk plus msp/10.5
- version/manageengine servicedesk plus msp/10.5-10500
- version/manageengine servicedesk plus msp/10.5-10501
- version/manageengine servicedesk plus msp/10.5-10502
- version/manageengine servicedesk plus msp/10.5-10503
- version/manageengine servicedesk plus msp/10.5-10504
- version/manageengine servicedesk plus msp/10.5-10505
- version/manageengine servicedesk plus msp/10.5-10506
- version/manageengine servicedesk plus msp/10.5-10507
- version/manageengine servicedesk plus msp/10.5-10508
- version/manageengine servicedesk plus msp/10.5-10509
- version/manageengine servicedesk plus msp/10.5-10510
- version/manageengine servicedesk plus msp/10.5-10511
- version/manageengine servicedesk plus msp/10.5-10512
- version/manageengine servicedesk plus msp/10.5-10513
- version/manageengine servicedesk plus msp/10.5-10514
- version/manageengine servicedesk plus msp/10.5-10515
- version/manageengine servicedesk plus msp/10.5-10516
- version/manageengine servicedesk plus msp/10.5-10517
- version/manageengine servicedesk plus msp/10.5-10518
- version/manageengine servicedesk plus msp/10.5-10519
- version/manageengine servicedesk plus msp/10.5-10520
- version/manageengine servicedesk plus msp/10.5-10521
- version/manageengine servicedesk plus msp/10.5-10522
- version/manageengine servicedesk plus msp/10.5-10523
- version/manageengine servicedesk plus msp/10.5-10524
- version/manageengine servicedesk plus msp/10.5-10525
- version/manageengine servicedesk plus msp/10.5-10526
- version/manageengine servicedesk plus msp/10.5-10527
- version/manageengine servicedesk plus msp/10.5-10528
- version/manageengine servicedesk plus msp/10.5-10529
- canonical/manageengine supportcenter plus
- version/manageengine supportcenter plus/11.0
- version/manageengine supportcenter plus/11.0-11000
- version/manageengine supportcenter plus/11.0-11001
- version/manageengine supportcenter plus/11.0-11002
- version/manageengine supportcenter plus/11.0-11003
- version/manageengine supportcenter plus/11.0-11004
- version/manageengine supportcenter plus/11.0-11005
- version/manageengine supportcenter plus/11.0-11006
- version/manageengine supportcenter plus/11.0-11007
- version/manageengine supportcenter plus/11.0-11008
- version/manageengine supportcenter plus/11.0-11009
- version/manageengine supportcenter plus/11.0-11010
- version/manageengine supportcenter plus/11.0-11011
- version/manageengine supportcenter plus/11.0-11012
- version/manageengine supportcenter plus/11.0-11013