CVE-2021-37415
Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability
Description
CVE-2021-37415 is a critical authentication bypass vulnerability in Zoho ManageEngine ServiceDesk Plus. Versions prior to 11302 expose certain REST-API endpoints without requiring authentication, allowing remote unauthenticated attackers to access critical functions that should be restricted. This missing authentication flaw in ManageEngine ServiceDesk Plus enables attackers to potentially compromise the entire IT service management platform. CISA has listed CVE-2021-37415 in its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and an EPSS score of 91.97% (99.7th percentile) indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zohocorp | manageengine servicedesk plus | 11.0; 11.1; 11.2; 11.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-306: Missing Authentication for Critical Function
In the context of CVE-2021-37415, Zoho ManageEngine ServiceDesk Plus fails to enforce authentication on several REST-API endpoints that provide access to critical functionality. This means unauthenticated remote users can directly invoke privileged API operations that should require valid credentials, bypassing all access controls.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2021-37415 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting maximum exploitability and impact. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and demands no user interaction — making it trivially easy for attackers to exploit. Successful exploitation fully compromises the confidentiality, integrity, and availability of the ManageEngine ServiceDesk Plus instance, potentially exposing sensitive IT service tickets, user credentials, and organizational data. With an EPSS score of 91.97%, this vulnerability is near-certain to be targeted by attackers. Organizations using affected versions face immediate risk of unauthorized access to their IT service management infrastructure.
Exploit Maturity
CVE-2021-37415 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-12-15. The EPSS score of 91.97% (99.7th percentile) indicates near-certain exploitation activity, placing this among the most actively targeted vulnerabilities. While no tagged public exploit code appears in the NVD references, the authentication bypass nature of the vulnerability makes exploitation straightforward for attackers who can reach the exposed REST-API endpoints. Organizations should treat this as an emergency requiring immediate remediation.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: update Zoho ManageEngine ServiceDesk Plus to version 11302 or later, which addresses the authentication bypass on REST-API endpoints.
- Verify that all instances of ManageEngine ServiceDesk Plus (versions 11.0, 11.1, 11.2, and 11.3 prior to build 11302) have been updated to the patched version.
- Restrict network access to ManageEngine ServiceDesk Plus REST-API endpoints using firewall rules and network segmentation, ensuring only authorized internal networks can reach the application.
- Review application logs and web server access logs for signs of unauthenticated access to REST-API URLs, particularly from external IP addresses, to determine if the vulnerability was exploited prior to patching.
- Implement defense-in-depth by placing ManageEngine ServiceDesk Plus behind a reverse proxy or web application firewall (WAF) that enforces authentication on all API endpoints, preventing future authentication bypass vulnerabilities from being directly exploitable.
Technical Details
CVE-2021-37415 affects Zoho ManageEngine ServiceDesk Plus versions before 11302, where certain REST-API URL paths are accessible without any authentication check. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), indicating that the application completely omits authentication for operations that require a proven user identity. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation requires only network access, with no complexity barriers, no privileges, and no user interaction. An attacker can send crafted HTTP requests directly to the exposed REST-API endpoints to perform privileged operations, potentially gaining full control over the ServiceDesk Plus instance and all managed IT service data.
Frequently Asked Questions
Is CVE-2021-37415 being actively exploited?
Yes. CVE-2021-37415 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 91.97% (99.7th percentile) indicates near-certain exploitation activity, making immediate remediation critical.
What products are affected by CVE-2021-37415?
CVE-2021-37415 affects Zoho ManageEngine ServiceDesk Plus versions 11.0, 11.1, 11.2, and 11.3 prior to build 11302. Organizations running any of these versions should update immediately.
How do I fix CVE-2021-37415?
Update Zoho ManageEngine ServiceDesk Plus to version 11302 or later. As an interim measure, restrict network access to the application's REST-API endpoints and deploy a web application firewall to enforce authentication on all API calls.
How severe is CVE-2021-37415?
CVE-2021-37415 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity tier. The combination of remote exploitation, no authentication requirement, low attack complexity, and full impact on confidentiality, integrity, and availability makes this an extremely dangerous vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.