CVE-2021-31531

CRITICAL

ManageEngine ServiceDesk Plus MSP < 10521 - Server-Side Request Forgery

Title source: llm

Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).

Core 3

Core References

Broken Link

Release Notes, Vendor Advisory

Various Sources

CVSS v3 9.8

EPSS 0.0564

EPSS Percentile 90.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-918

Status published

Products (2)

zohocorp/manageengine_servicedesk_plus_msp 10.5 (22 CPE variants)

zohocorp/manageengine_servicedesk_plus_msp < 10.5

Published Jun 29, 2021

Tracked Since Feb 18, 2026