CVE-2021-33617

PoC —

CVSS 3.1

5.3 medium

EPSS

2%p80

Published

Jul 31, 2021 (Jul 31, 2021)

Modified

Jun 17, 2026

Description

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid.

Vendors: zohocorp
Products: manageengine password manager pro
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (2.1%)

In the news2 stories

APT Expands Attack on ManageEngine With Active Campaign Against ServiceDesk Plus

Palo Alto Unit 42Jun 6, 01:25 UTC · Jun 6, 2024Threat actor in the wildCVE-2021-44077 CVE-2021-33617

Determined APT is exploiting ManageEngine ServiceDesk Plus vulnerability (CVE-2021-44077)

Help Net SecurityDec 3, 00:00 UTC · Dec 3, 2021Vulnerability in the wildCVE-2021-44077 CVE-2021-33617