CVE-2021-44525

CRITICAL

Zohocorp Manageengine Pam360 - Authentication Bypass

Title source: rule

Description

Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which authentication is not required.

References (1)

Scores

CVSS v3 9.8
EPSS 0.0057
EPSS Percentile 68.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-287
Status published

Affected Products (23)

zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
zohocorp/manageengine_pam360
... and 8 more

Timeline

Published Dec 20, 2021
Tracked Since Feb 18, 2026