CVE-2021-31159 Information disclosure in n/a

What is CVE-2021-31159?

CVE-2021-31159 is a medium-severity vulnerability in n/a, published on 16 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.

Weakness: CWE-209

Which versions are affected by CVE-2021-31159?

It affects 1 product.

Products include Zohocorp Manageengine Servicedesk Plus Msp.

How do I fix CVE-2021-31159?

No fix has been published for CVE-2021-31159 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-31159 being exploited?

There is no known exploitation of CVE-2021-31159 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2021-44675 Auth bypass in n/a Critical 9.8
• CVE-2021-31531 Server-side request forgery in n/a Critical 9.8
• CVE-2023-22964 Auth bypass in n/a Critical 9.1
• CVE-2022-40773 Privilege escalation in n/a High 8.8
• CVE-2022-32551 Path traversal in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p9qp-995j-9pxx.