What’s Vulnerable › Vulnerabilities

CVE-2021-31159

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 17.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-16 · updated 2026-06-17
• Weakness: CWE-209

Description

Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.

Affected products

• Zohocorp Manageengine Servicedesk Plus Msp: from 8.0 through 9.4; 10.5-10500, 10.5-10501, 10.5-10502, 10.5-10503, 10.5-10504, 10.5-10505 (+105)

References

• http://packetstormsecurity.com/files/163192/Zoho-ManageEngine-ServiceDesk-Plus-9.4-User-Enumeration.html
• https://github.com/ricardojoserf/CVE-2021-31159
• https://www.manageengine.com
• https://www.manageengine.com/products/service-desk-msp/readme.html#10519
• http://packetstormsecurity.com/files/163192/Zoho-ManageEngine-ServiceDesk-Plus-9.4-User-Enumeration.html
• https://github.com/ricardojoserf/CVE-2021-31159
• https://www.manageengine.com
• https://www.manageengine.com/products/service-desk-msp/readme.html#10519

Get alerted when CVE-2021-31159 or the next vulnerability affects your stack