Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 01/12/2021. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| manageengine servicedesk plus | = 11.1= 11.2= 11.3< 11.1 | 11.1 |
| manageengine servicedesk plus msp | = 10.5< 10.5 | 10.5 |
| manageengine supportcenter plus | = 11.0< 11.0 | 11.0 |
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free