CVE-2021-44526: 
Zoho ManageEngine ServiceDesk Plus vulnerability analysis and mitigation

Zoho ManageEngine ServiceDesk Plus before version 12003 contains an authentication bypass vulnerability (CVE-2021-44526) that affects certain admin configurations. The vulnerability was disclosed in December 2021 (NVD, CVE).

The vulnerability exists due to a flaw in the application filters used in the list view. Using a crafted URL, an attacker can access a servlet that should only be available to an authenticated user. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 CRITICAL with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

A successful exploitation of this vulnerability could allow an unauthenticated attacker to bypass authentication mechanisms and gain unauthorized access to admin configurations. This could potentially lead to unauthorized access to sensitive information and system compromise (Tenable).

Zoho has released patches to address this vulnerability. Organizations using ManageEngine ServiceDesk Plus should upgrade to version 12003 or later to mitigate this security issue. The fix includes additional checks to ensure the filters are properly configured to prevent authentication bypass (Vendor Advisory).