CVE-2021-44675: Critical severity zohocorp manageengine servicedesk plus msp vulnerability

Published Dec 20, 2021
·
Updated

Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required.

Affected Software

35 affected components
ZohoCorp ManageEngine ServiceDesk Plus MSP<=10.5
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10500
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10501
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10502
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10503
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10504
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10505
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10506
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10507
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10508
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10509
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10510
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10511
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10512
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10513
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10514
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10515
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10516
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10517
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10518
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10519
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10520
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10521
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10522
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10523
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10524
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10525
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10526
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10527
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10528
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10529
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10530
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10531
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10532
ZohoCorp ManageEngine ServiceDesk Plus MSP=10.5-10533

Event History

Dec 20, 2021
CVE Published
via MITRE·02:57 PM
Data Sourced
via MITRE·02:57 PM
Description
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-44675.

2

What is the severity of CVE-2021-44675?

The severity of CVE-2021-44675 is critical with a CVSS score of 9.8.

3

What software is affected by CVE-2021-44675?

Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is affected by CVE-2021-44675.

4

Is authentication required for exploitation?

No, authentication is not required for exploitation of CVE-2021-44675.

5

How do I fix CVE-2021-44675?

To fix CVE-2021-44675, update Zoho ManageEngine ServiceDesk Plus MSP to version 10.5 Build 10534 or later.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203