ZOHO ManageEngine ServiceDesk Plus代码执行漏洞

详细信息

漏洞类型

授权问题

漏洞描述

ZOHO ManageEngine ServiceDesk Plus（SDP）是美国卓豪（ZOHO）公司的一套基于ITIL架构的IT服务管理软件。该软件集成了事件管理、问题管理、资产管理IT项目管理、采购与合同管理等功能模块。 11306之前的Zoho ManageEngine ServiceDesk Plus、10530之前的ServiceDesk Plus MSP和11014之前的SupportCenter Plus易受未经验证的远程代码执行攻击。这与servlet中的/RestAPI URL和Struts配置中的ImportTechnician相关。

修复建议

升级至最新版本的ServiceDesk Plus（11306或更高版本）、ServiceDesk Plus MSP（10530或更高版本）、SupportCenter Plus（11014或更高版本），可从ManageEngine网站获得： https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-supportcenter-plus-versions-11012-and-11013

参考链接

• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021

  CVE · x_refsource_MISC

• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above

  CVE · x_refsource_MISC

• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-msp-versions-10527-till-10529

  CVE · x_refsource_MISC

• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-supportcenter-plus-versions-11012-and-11013

  CVE · x_refsource_MISC

• https://nvd.nist.gov/vuln/detail/CVE-2021-44077
• https://www.cybersecurity-help.cz/vdb/SB2021120304
• http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html

  CVE · x_refsource_MISC

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44077

  NVD · US Government Resource