CVE-2021-37415

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Sep 1, 2021
Last modified
Jun 17, 2026
Added to CISA KEV
Dec 1, 2021
NVD status
Analyzed

Related CVEs from 2021

CVE-2021-374166.1Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.CVE-2021-374179.8Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.CVE-2021-374197.5Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.CVE-2021-37428.8A Server-Side Request Forgery (SSRF) vulnerability was discovered in chatwoot/chatwoot, affecting all versions prior to 2.5.0. The vulnerabiCVE-2021-374206.5Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.CVE-2021-374219.8Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.CVE-2021-374229.8Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.CVE-2021-374239.8Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.CVE-2021-374249.8ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.CVE-2021-374259.1Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reaCVE-2021-37437.1An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a lCVE-2021-374364.2Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers, who have physical access to a device after a factory reset, to obtain
CVE-2021-37415: Critical severity, CVSS 9.8 | Vulnix