Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-42099

Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution.

Security Impact Summary

This vulnerability carries a CRITICAL severity rating with a CVSS v3.1 score of 9.8, indicating it can be exploited remotely over the network with relatively low complexity without requiring user interaction and does not require pre-existing privileges . The vulnerability impacts confidentiality (data exposure), integrity (unauthorized modifications), and availability (service disruption) for affected systems. Impacting 1 product from zohocorp organizations running these solutions should prioritize assessment and patching.

Historical Context

Reported in 2021, this vulnerability emerged during an era marked by increased sophistication in supply chain attacks, cloud infrastructure vulnerabilities, and software-as-a-service (SaaS) security challenges. Security practices during this period emphasized zero-trust architectures, container security, and API protection.

Published

2021-11-30T19:15:09.140

Last Modified

2024-11-21T06:27:15.473

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-434
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application zohocorp manageengine_m365_manager_plus - Yes
Application zohocorp manageengine_m365_manager_plus build_4000 Yes
Application zohocorp manageengine_m365_manager_plus build_4001 Yes
Application zohocorp manageengine_m365_manager_plus build_4002 Yes
Application zohocorp manageengine_m365_manager_plus build_4003 Yes
Application zohocorp manageengine_m365_manager_plus build_4004 Yes
Application zohocorp manageengine_m365_manager_plus build_4005 Yes
Application zohocorp manageengine_m365_manager_plus build_4007 Yes
Application zohocorp manageengine_m365_manager_plus build_4008 Yes
Application zohocorp manageengine_m365_manager_plus build_4009 Yes
Application zohocorp manageengine_m365_manager_plus build_4010 Yes
Application zohocorp manageengine_m365_manager_plus build_4011 Yes
Application zohocorp manageengine_m365_manager_plus build_4012 Yes
Application zohocorp manageengine_m365_manager_plus build_4013 Yes
Application zohocorp manageengine_m365_manager_plus build_4014 Yes
Application zohocorp manageengine_m365_manager_plus build_4100 Yes
Application zohocorp manageengine_m365_manager_plus build_4101 Yes
Application zohocorp manageengine_m365_manager_plus build_4102 Yes
Application zohocorp manageengine_m365_manager_plus build_4103 Yes
Application zohocorp manageengine_m365_manager_plus build_4104 Yes
Application zohocorp manageengine_m365_manager_plus build_4105 Yes
Application zohocorp manageengine_m365_manager_plus build_4106 Yes
Application zohocorp manageengine_m365_manager_plus build_4108 Yes
Application zohocorp manageengine_m365_manager_plus build_4109 Yes
Application zohocorp manageengine_m365_manager_plus build_4110 Yes
Application zohocorp manageengine_m365_manager_plus build_4111 Yes
Application zohocorp manageengine_m365_manager_plus build_4112 Yes
Application zohocorp manageengine_m365_manager_plus build_4113 Yes
Application zohocorp manageengine_m365_manager_plus build_4115 Yes
Application zohocorp manageengine_m365_manager_plus build_4116 Yes
Application zohocorp manageengine_m365_manager_plus build_4117 Yes
Application zohocorp manageengine_m365_manager_plus build_4118 Yes
Application zohocorp manageengine_m365_manager_plus build_4119 Yes
Application zohocorp manageengine_m365_manager_plus build_4200 Yes
Application zohocorp manageengine_m365_manager_plus build_4201 Yes
Application zohocorp manageengine_m365_manager_plus build_4202 Yes
Application zohocorp manageengine_m365_manager_plus build_4203 Yes
Application zohocorp manageengine_m365_manager_plus build_4204 Yes
Application zohocorp manageengine_m365_manager_plus build_4205 Yes
Application zohocorp manageengine_m365_manager_plus build_4206 Yes
Application zohocorp manageengine_m365_manager_plus build_4207 Yes
Application zohocorp manageengine_m365_manager_plus build_4208 Yes
Application zohocorp manageengine_m365_manager_plus build_4209 Yes
Application zohocorp manageengine_m365_manager_plus build_4210 Yes
Application zohocorp manageengine_m365_manager_plus build_4211 Yes
Application zohocorp manageengine_m365_manager_plus build_4212 Yes
Application zohocorp manageengine_m365_manager_plus build_4213 Yes
Application zohocorp manageengine_m365_manager_plus build_4214 Yes
Application zohocorp manageengine_m365_manager_plus build_4215 Yes
Application zohocorp manageengine_m365_manager_plus build_4216 Yes
Application zohocorp manageengine_m365_manager_plus build_4217 Yes
Application zohocorp manageengine_m365_manager_plus build_4218 Yes
Application zohocorp manageengine_m365_manager_plus build_4219 Yes
Application zohocorp manageengine_m365_manager_plus build_4220 Yes
Application zohocorp manageengine_m365_manager_plus build_4221 Yes
Application zohocorp manageengine_m365_manager_plus build_4222 Yes
Application zohocorp manageengine_m365_manager_plus build_4300 Yes
Application zohocorp manageengine_m365_manager_plus build_4301 Yes
Application zohocorp manageengine_m365_manager_plus build_4302 Yes
Application zohocorp manageengine_m365_manager_plus build_4303 Yes
Application zohocorp manageengine_m365_manager_plus build_4304 Yes
Application zohocorp manageengine_m365_manager_plus build_4305 Yes
Application zohocorp manageengine_m365_manager_plus build_4306 Yes
Application zohocorp manageengine_m365_manager_plus build_4308 Yes
Application zohocorp manageengine_m365_manager_plus build_4309 Yes
Application zohocorp manageengine_m365_manager_plus build_4310 Yes
Application zohocorp manageengine_m365_manager_plus build_4311 Yes
Application zohocorp manageengine_m365_manager_plus build_4312 Yes
Application zohocorp manageengine_m365_manager_plus build_4316 Yes
Application zohocorp manageengine_m365_manager_plus build_4317 Yes
Application zohocorp manageengine_m365_manager_plus build_4318 Yes
Application zohocorp manageengine_m365_manager_plus build_4319 Yes
Application zohocorp manageengine_m365_manager_plus build_4320 Yes
Application zohocorp manageengine_m365_manager_plus build_4321 Yes
Application zohocorp manageengine_m365_manager_plus build_4322 Yes
Application zohocorp manageengine_m365_manager_plus build_4324 Yes
Application zohocorp manageengine_m365_manager_plus build_4325 Yes
Application zohocorp manageengine_m365_manager_plus build_4327 Yes
Application zohocorp manageengine_m365_manager_plus build_4328 Yes
Application zohocorp manageengine_m365_manager_plus build_4329 Yes
Application zohocorp manageengine_m365_manager_plus build_4330 Yes
Application zohocorp manageengine_m365_manager_plus build_4331 Yes
Application zohocorp manageengine_m365_manager_plus build_4332 Yes
Application zohocorp manageengine_m365_manager_plus build_4333 Yes
Application zohocorp manageengine_m365_manager_plus build_4334 Yes
Application zohocorp manageengine_m365_manager_plus build_4335 Yes
Application zohocorp manageengine_m365_manager_plus build_4336 Yes
Application zohocorp manageengine_m365_manager_plus build_4400 Yes
Application zohocorp manageengine_m365_manager_plus build_4401 Yes
Application zohocorp manageengine_m365_manager_plus build_4402 Yes
Application zohocorp manageengine_m365_manager_plus build_4403 Yes
Application zohocorp manageengine_m365_manager_plus build_4406 Yes
Application zohocorp manageengine_m365_manager_plus build_4407 Yes
Application zohocorp manageengine_m365_manager_plus build_4408 Yes
Application zohocorp manageengine_m365_manager_plus build_4410 Yes
Application zohocorp manageengine_m365_manager_plus build_4411 Yes
Application zohocorp manageengine_m365_manager_plus build_4412 Yes
Application zohocorp manageengine_m365_manager_plus build_4413 Yes
Application zohocorp manageengine_m365_manager_plus build_4414 Yes
Application zohocorp manageengine_m365_manager_plus build_4415 Yes
Application zohocorp manageengine_m365_manager_plus build_4416 Yes
Application zohocorp manageengine_m365_manager_plus build_4417 Yes
Application zohocorp manageengine_m365_manager_plus build_4418 Yes
Application zohocorp manageengine_m365_manager_plus build_4419 Yes
References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For zohocorp's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.