Authentication Bypass in Zoho ManageEngine ServiceDesk Plus (CVE‑2021‑37415) Threatens ITSM Environments
What It Is – A flaw in ServiceDesk Plus < v11302 allows unauthenticated callers to reach several REST‑API endpoints, effectively bypassing the login process.
Exploitability – Publicly disclosed; proof‑of‑concept requests have been shared on security forums. The CVSS v3.1 base score is 7.5 (High).
Affected Products – Zoho ManageEngine ServiceDesk Plus (all versions prior to 11302).
Why It Matters for Trust & Control Assurance
- Access‑control assurance – The vulnerability demonstrates a gap in authentication enforcement, a core control that underpins many framework requirements (e.g., “ensure only authorized users can access privileged functions”).
- Continuous monitoring – Detecting anomalous API calls without a valid session is essential for evidencing that access controls are operating as intended.
- Audit readiness – Organizations must be able to show that they have patched known authentication weaknesses and retain logs proving legitimate versus illegitimate API activity.
Recommended Actions
- Upgrade ServiceDesk Plus to version 11302 or later immediately.
- Review and restrict API endpoint exposure; enforce least‑privilege access.
- Enable multi‑factor authentication for all administrative accounts.
- Deploy logging and alerting on the affected REST‑API calls to capture any unauthorized attempts.
- Document the remediation steps in your control evidence repository for audit purposes.
Source: CISA KEV – CVE‑2021‑37415