CVE-2021-27214: 
Zoho ManageEngine ADSelfService Plus vulnerability analysis and mitigation

A Server-side request forgery (SSRF) vulnerability was discovered in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through version 6013. The vulnerability allows remote unauthenticated attackers to perform blind HTTP requests or execute cross-site scripting (XSS) attacks against the administrative interface via an HTTP request. This is tracked as CVE-2021-27214 and is distinct from CVE-2019-3905 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Under CVSS v2.0, it received a base score of 4.3 (MEDIUM) with vector (AV:N/AC:M/Au:N/C:N/I:P/A:N). The vulnerability affects the ProductConfig servlet component and involves both SSRF and XSS attack vectors (NVD).

The vulnerability allows attackers to perform blind HTTP requests, which could enable server-side request forgery attacks. Additionally, it enables cross-site scripting attacks against the administrative interface, potentially compromising administrator sessions (NVD).

The vulnerability can be exploited remotely by unauthenticated attackers. It requires user interaction for successful exploitation, as indicated by the CVSS metrics. The attack complexity is considered low, making it relatively straightforward to exploit (NVD).

Zoho has addressed this vulnerability in ManageEngine ADSelfService Plus. Users should upgrade to a version newer than 6013 to mitigate the risk. The fix is documented in the product's release notes (Release Notes).