// For flags

CVE-2021-42956

 

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper privilege management, the process launches as the logged in user, so memory dump can be done by non-admin also. Remotely, an attacker can dump all sensitive information including DB Connection string, entire IT infrastructure details, commands executed by IT admin including credentials, secrets, private keys and more.

Zoho Remote Access Plus Server Windows Desktop Binary corregido en versión 10.1.2132.6 está afectado por una vulnerabilidad de divulgación de información confidencial. Debido a una administración inapropiada de privilegios, el proceso se lanza como el usuario que ha iniciado la sesión, por lo que el volcado de memoria puede ser realizado también por personas que no son administradores. De forma remota, un atacante puede volcar toda la información confidencial, incluyendo la cadena de conexión de la base de datos, todos los detalles de la infraestructura de TI, los comandos ejecutados por el administrador de TI, incluyendo credenciales, secretos, claves privadas y más

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-10-25 CVE Reserved
  • 2021-11-17 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • 2024-10-09 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-269: Improper Privilege Management
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Zoho
Search vendor "Zoho"
Manageengine Remote Access Plus Server
Search vendor "Zoho" for product "Manageengine Remote Access Plus Server"
< 10.1.2132.6
Search vendor "Zoho" for product "Manageengine Remote Access Plus Server" and version " < 10.1.2132.6"
-
Affected
in Microsoft
Search vendor "Microsoft"
Windows
Search vendor "Microsoft" for product "Windows"
--
Safe