CVE-2021-20131

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the Personalization interface.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-201328.8Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attack CVE-2021-201336.1Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allow CVE-2021-201348.4Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allow CVE-2021-201356.7Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, loca CVE-2021-201369.8ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An una CVE-2021-201376.1A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower route CVE-2021-201388.8An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luc CVE-2021-201398.8An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server service on Gryphon Tower CVE-2021-20144.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). Supported versions that are affected are 5.7 CVE-2021-201408.8An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server service on Gryphon Towe CVE-2021-201418.8An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon Towe CVE-2021-201428.8An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server service on Gryphon Towe