CVE-2021-31159

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/163192/Zoho-ManageEngine-ServiceDesk-Plus-9.4-User-Enumeration.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/ricardojoserf/CVE-2021-31159Exploit, Third Party Advisory
https://www.manageengine.comProduct
https://www.manageengine.com/products/service-desk-msp/readme.html#10519Release Notes, Vendor Advisory
http://packetstormsecurity.com/files/163192/Zoho-ManageEngine-ServiceDesk-Plus-9.4-User-Enumeration.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/ricardojoserf/CVE-2021-31159Exploit, Third Party Advisory
https://www.manageengine.comProduct
https://www.manageengine.com/products/service-desk-msp/readme.html#10519Release Notes, Vendor Advisory

Timeline

Published: Jun 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-31167.5before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data be CVE-2021-311607.5Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.CVE-2021-311629.8In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics.CVE-2021-311647.5Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.CVE-2021-311657.8Windows Container Manager Service Elevation of Privilege Vulnerability CVE-2021-311669.8HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2021-311677.8Windows Container Manager Service Elevation of Privilege Vulnerability CVE-2021-311687.8Windows Container Manager Service Elevation of Privilege Vulnerability CVE-2021-311697.8Windows Container Manager Service Elevation of Privilege Vulnerability CVE-2021-311707.8Windows Graphics Component Elevation of Privilege Vulnerability CVE-2021-311714.1Microsoft SharePoint Information Disclosure Vulnerability CVE-2021-311727.1Microsoft SharePoint Server Spoofing Vulnerability