Intrusion PreventionManageEngine.ServiceDesk.Plus.RestAPI.Authentication.Bypass
Description
This indicates an attack attempt to exploit an Authentication Bypass Vulnerability in Zoho Corporation ManageEngine ServiceDesk Plus.
This vulnerability is due to improper handling of a parameter in the vulnerable application. A remote attacker could exploit this vulnerability by sending a crafted HTTP request to the target device. Successful exploitation of the vulnerability could lead to execution of arbitrary code.
Outbreak Alert
APT Actors are actively exploiting Zoho ManageEngine ServiceDesk Plus which is an IT help desk software with asset management. The exploit is tracked via CVE-2021-44077 and rated critical due to its capability for unauthenticated remote code execution (RCE).
Affected Products
Zoho ManageEngine ServiceDesk Plus version 11305 and prior
Impact
System Compromise: Remote attackers can gain control of vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://www.manageengine.com/products/service-desk/security-response-plan.html
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
Version Updates
| Date | Version | Detail |
|---|---|---|
| 2023-08-07 | 25.615 | Name:Zoho. ME. ServiceDesk. Plus. RestAPI. Authentication. Bypass:ManageEngine. ServiceDesk. Plus. RestAPI. Authentication. Bypass |
| 2022-01-12 | 19.238 | Default_action:pass:drop |
| 2021-12-15 | 19.219 |
| ID | 50988 |
| Created | Dec 07, 2021 |
| Updated | Aug 03, 2023 |
| Outbreak Alert | Zoho Exploit |
| Risk |
|
| CVE ID | CVE-2021-44077 |
| Known Exploited | Yes |
| Exploit Prediction Score | 97.38% |
| Default Action | drop |
| Active | |
| Affected OS | Windows, Linux |
| Affected App | Other |