CVE-2021-40173

high-risk

Published 2021-08-29

Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings.

Do I need to act?

-

0.57% chance of exploitation

EPSS score — low exploit probability

-

Not on CISA KEV list

No confirmed active exploitation reported to CISA

?

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

8

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (17)

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Manageengine Cloud Security Plus

Affected Vendors

Zohocorp

References (2)

Release Notes https://www.manageengine.com/cloud-security/release-notes.html#build%204117

Release Notes https://www.manageengine.com/cloud-security/release-notes.html#build%204117

51

/ 100

high-risk

Severity 30/34 · Critical

Exploitability 2/34 · Minimal

Exposure 19/34 · Moderate