High severity · published Aug 29, 2021
CVE-2021-40173
Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings
8.8
CVSS
1%
EPSS
No
On KEV
Description
Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
Manageengine Cloud Security Plus · Zohocorp
through 4.0; 4.1; 4.1; 4.1; 4.1; 4.1; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-40173
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-40173
Release Notes
https://www.manageengine.com/cloud-security/release-notes.html#build%204117
More from Manageengine Cloud Security Plus
9.8
CVE-2020-24786
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817,…
8.8
CVE-2021-44651
Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security patch for…
8.1
CVE-2023-35785
Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and below and 7xxx 7002 and below,…
5.5
CVE-2023-6105
An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed