Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

The Zoho ManageEngine ADSelfService Plus running on the remote host is affected by an authentication bypass vulnerability in the REST API which can lead to remote code execution.

The ManageEngine EventLog Analyzer running on the remote host is affected by a security restriction bypass vulnerability due to improper validation of user-supplied data. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to execute arbitrary code on the remote host.

The ManageEngine Log360 running on the remote host is affected by a security restriction bypass vulnerability due to improper validation of user-supplied data. An unauthenticated, remote attacker can exploit this, via a specially crafted message, to execute arbitrary code on the remote host.

According to its self-reported version, the ManageEngine ADSelfService Plus application running on the remote host is prior to build 6114. It is, therefore, affected by an authentication bypass vulnerability affecting REST API URLs. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary code.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported build number.

ID	Name	Product	Family	Severity
154964	ManageEngine ADSelfServicePlus Authentication Bypass (CVE-2021-40539)	Nessus	CGI abuses	critical
153848	ManageEngine EventLog Analyzer < Build 12201 REST API Restriction Bypass RCE	Nessus	CGI abuses	critical
153636	ManageEngine Log360 < Build 5229 REST API Restriction Bypass RCE	Nessus	CGI abuses	critical
153147	ManageEngine ADSelfService Plus < build 6114 REST API Authentication Bypass	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2021-40539

critical

Tenable Plugins

critical

critical

critical

critical