CVE-2021-27214

MEDIUM 6.1CVE-2021-27214 · Published 19/02/2021 · updated 17/06/2026

In short

CVE-2021-27214 is a MEDIUM (CVSS 6.1) vulnerability affecting manageengine adselfservice plus (zohocorp).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 81.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
manageengine adselfservice plus zohocorp	`= 6.0`	No fix yet

Description

A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative interface via an HTTP request, a different vulnerability than CVE-2019-3905.

References

horizonsecurity.it/lang_EN/advisories · Exploit
manageengine.com/products/self-service-password/release-notes.html · Release Notes

More vulnerabilities in manageengine adselfservice plus

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

manageengine adselfservice plus

zohocorp

= 6.0

No fix yet

Description

More vulnerabilities in manageengine adselfservice plus

See all →