CVE-2021-44650

high-risk

Published 2022-01-12

Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components.

Do I need to act?

~

4.6% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

-

Not on CISA KEV list

No confirmed active exploitation reported to CISA

?

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

7

CVSS 7.2/10 High

NETWORK / LOW complexity

Affected Products (18)

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Manageengine M365 Manager Plus

Affected Vendors

Zohocorp

References (2)

Vendor Advisory https://www.manageengine.com/microsoft-365-management-reporting/release-notes.ht...

Vendor Advisory https://www.manageengine.com/microsoft-365-management-reporting/release-notes.ht...

53

/ 100

high-risk

Severity 26/34 · High

Exploitability 8/34 · Low

Exposure 19/34 · Moderate