CVE-2021-33617

CVSS 3.1: 5.3 medium
EPSS: 2%p81
Published: Jul 31, 2021 · Jul 31, 2021
Modified: Jun 17, 2026

Analyze CVE-2021-33617 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid.

Vendors: zohocorp

Products: manageengine password manager pro

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (2.1%)

In the news

2 stories

APT Expands Attack on ManageEngine With Active Campaign Against ServiceDesk Plus

Palo Alto Unit 42Jun 6, 01:25 UTC · Jun 6, 2024Threat actorExploitedCVE-2021-44077 CVE-2021-336174

Determined APT is exploiting ManageEngine ServiceDesk Plus vulnerability (CVE-2021-44077)

Help Net SecurityDec 3, 00:00 UTC · Dec 3, 2021VulnerabilityExploitedCVE-2021-44077 CVE-2021-336173