CVE-2021-44757

critical · 9.1

Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server.

9.1

CVSS

24.2%

EPSS (exploit prob.)

98th

EPSS percentile

2022-01-18

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Vendor	Product	Affected versions
zohocorp	manageengine_desktop_central	< 10.1.2137.9
zohocorp	manageengine_desktop_central_managed_service_providers	< 10.1.2137.9

Check a specific version with /api/v1/cve/match.

References

https://pitstop.manageengine.com/portal/en/community/topic/a-critical-security-patch-released-in-desktop-central-and-desktop-central-msp-for-cve-2021-44757-17-1-2022
https://pitstop.manageengine.com/portal/en/community/topic/a-critical-security-patch-released-in-desktop-central-and-desktop-central-msp-for-cve-2021-44757-17-1-2022

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-44757