CVE-2021-37419 Server-side request forgery in n/a

What is CVE-2021-37419?

CVE-2021-37419 is a high-severity server-side request forgery vulnerability in Zohocorp Manageengine Admanager Plus, published on 21 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.

Weakness: CWE-918

Which versions are affected by CVE-2021-37419?

It affects 1 product.

Products include Zohocorp Manageengine Admanager Plus.

How do I fix CVE-2021-37419?

No fix has been published for CVE-2021-37419 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2021-37419 being exploited?

There is no known exploitation of CVE-2021-37419 in the wild and no public exploit code.

Other vulnerabilities in Zohocorp Manageengine Admanager Plus

• CVE-2021-42002 File upload in n/a Critical 9.8
• CVE-2021-37762 File upload in n/a Critical 9.8
• CVE-2021-37918 File upload in n/a Critical 9.8
• CVE-2021-37919 File upload in n/a Critical 9.8
• CVE-2021-37920 File upload in n/a Critical 9.8

All Zohocorp Manageengine Admanager Plus vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xq7h-5h92-cwp8.