Cloud Vulnerability DB
A community-led vulnerabilities database
Introducing Wiz for Exposure Management: Unify, prioritize, and remediate exposures everywhere.
Vulnerability DatabaseCVE-2021-37414
CVE-2021-37414:
Zoho ManageEngine Desktop Central Server vulnerability analysis and mitigation
Overview
Zoho ManageEngine DesktopCentral before version 10.0.709 contained a critical authentication vulnerability that allowed unauthorized users to obtain a valid user's APIKEY without requiring authentication. The vulnerability was discovered and disclosed in July 2021 (Vendor Advisory).
Technical details
The vulnerability stemmed from an endpoint with insufficient access control in the server, which when exploited, could potentially lead to gaining unauthorized access to the Endpoint Central instance. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).
Impact
The vulnerability allowed attackers to obtain valid user APIKEYs without authentication, potentially leading to unauthorized access to the Endpoint Central instance. This could result in exposure of sensitive information and potential system compromise (Vendor Advisory).
Mitigation and workarounds
The vulnerability was patched in DesktopCentral build 10.0.709 released on July 23, 2021. Users are strongly advised to upgrade to this version or later. The vulnerability does not affect cloud editions of Endpoint Central, Patch Manager Plus and Remote Access Plus (Vendor Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management