Vulnerability Details CVE-2021-33617
Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 64.1%
CVSS Severity
CVSS v3 Score 5.3
CVSS v2 Score 5.0
References
- https://herolab.usd.de/security-advisories/usd-2021-0015/
- https://www.manageengine.com
- https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11200
- https://herolab.usd.de/security-advisories/usd-2021-0015/
- https://www.manageengine.com
- https://www.manageengine.com/products/passwordmanagerpro/release-notes.html#pmp11200
Products affected by CVE-2021-33617
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.0
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.1
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.2
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.3
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.4
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:10.5
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.0
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.1
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:11.2
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:4.6
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:4.7
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:4.8
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.0
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.1
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.2
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.3
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:5.4
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.0
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.1
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.2
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.3
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.4
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.5
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.6
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.7
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.8
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:6.9
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.0
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.1
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.5
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:7.6
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.0
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.1
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.2
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.3
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.4
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.5
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.6
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:8.7
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.0
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.1
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.2
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.3
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.4
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.5
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.6
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.7
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.8
-
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:9.9