What’s Vulnerable › Vulnerabilities

CVE-2021-27214

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-02-19 · updated 2026-06-17
• Weakness: CWE-79

Description

A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative interface via an HTTP request, a different vulnerability than CVE-2019-3905.

Affected products

• ManageEngine ADSelfService Plus: 6.0, 6.0-6000, 6.0-6001, 6.0-6002, 6.0-6003, 6.0-6004 (+7)

References

• https://www.horizonsecurity.it/lang_EN/advisories/?a=20&title=ManageEngine+ADSelfService+Plus+privilege+escalation++CVE202127214
• https://www.manageengine.com/products/self-service-password/release-notes.html
• https://www.horizonsecurity.it/lang_EN/advisories/?a=20&title=ManageEngine+ADSelfService+Plus+privilege+escalation++CVE202127214
• https://www.manageengine.com/products/self-service-password/release-notes.html

Get alerted when CVE-2021-27214 or the next vulnerability affects your stack