Vulnerability · Published Jun 16, 2021 · Assigned by mitre
CVE-2021-31159
Medium 5.3
In plain English
A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 17.8% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)17.8%top 2.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.
Affected products (as reported)
References
- https://www.manageengine.com x_refsource_MISC
- https://www.manageengine.com/products/service-desk-msp/readme.html#10519 x_refsource_CONFIRM
- http://packetstormsecurity.com/files/163192/Zoho-ManageEngine-ServiceDesk-Plus-9.4-User-Enumeration.html x_refsource_MISC
- https://github.com/ricardojoserf/CVE-2021-31159 x_refsource_MISC