Exploit for #VU56414 Improper access control in Zoho ManageEngine ADSelfService Plus

Cybersecurity Help s.r.o.

Published: 2021-11-04 | Updated: 2021-11-24

Vulnerability identifier: #VU56414

Vulnerability risk: Critical

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2021-40539

CWE-ID: CWE-284

Exploitation vector: Network

Exploits in database: 2

November 24, 2021
- ManageEngine ADSelfService Plus CVE-2021-40539 [Metasploit]
November 4, 2021
- CVE-2021-40539 (Exploitation code for CVE-2021-40539) [Github]

Vulnerable software:
Zoho ManageEngine ADSelfService Plus
Client/Desktop applications / Software for system administration

Vendor: Zoho Corporation