Read the docs
TI-2021-17353 Aliases CVE-2021-40173GHSA-pgx3-96qh-rj6x

Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings.

Priority MEDIUM 40CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings.

Why it matters now

EPSS 0.00994 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:*:*:*:*:*:*:*:*up to 4.0VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4100:*:*:*:*:*:*4.1 4100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4101:*:*:*:*:*:*4.1 4101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4102:*:*:*:*:*:*4.1 4102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4103:*:*:*:*:*:*4.1 4103VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4104:*:*:*:*:*:*4.1 4104VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4105:*:*:*:*:*:*4.1 4105VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4106:*:*:*:*:*:*4.1 4106VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4107:*:*:*:*:*:*4.1 4107VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4108:*:*:*:*:*:*4.1 4108VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:*:*:*:*:*:*:*:* Versions up to 4.0 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4100:*:*:*:*:*:* Versions 4.1 4100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4101:*:*:*:*:*:* Versions 4.1 4101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4102:*:*:*:*:*:* Versions 4.1 4102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4103:*:*:*:*:*:* Versions 4.1 4103 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4104:*:*:*:*:*:* Versions 4.1 4104 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4105:*:*:*:*:*:* Versions 4.1 4105 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4106:*:*:*:*:*:* Versions 4.1 4106 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4107:*:*:*:*:*:* Versions 4.1 4107 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4108:*:*:*:*:*:* Versions 4.1 4108 Vulnerable ·Zohocorp
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4109:*:*:*:*:*:*4.1 4109VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4110:*:*:*:*:*:*4.1 4110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4111:*:*:*:*:*:*4.1 4111VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4112:*:*:*:*:*:*4.1 4112VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4113:*:*:*:*:*:*4.1 4113VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4115:*:*:*:*:*:*4.1 4115VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4116:*:*:*:*:*:*4.1 4116VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4109:*:*:*:*:*:* Versions 4.1 4109 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4110:*:*:*:*:*:* Versions 4.1 4110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4111:*:*:*:*:*:* Versions 4.1 4111 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4112:*:*:*:*:*:* Versions 4.1 4112 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4113:*:*:*:*:*:* Versions 4.1 4113 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4115:*:*:*:*:*:* Versions 4.1 4115 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_cloud_security_plus:4.1:4116:*:*:*:*:*:* Versions 4.1 4116 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-40173
  2. 2026-10-03 Alias added: GHSA-pgx3-96qh-rj6x

References

Advisory 1

  • TI-2020-15194 An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number… CVSS 3.1CRITICAL 9.8
  • TI-2021-20188 Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution… CVSS 3.1HIGH 8.8
  • TI-2023-17875 Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and… CVSS 3.1HIGH 8.1
  • TI-2023-05614 ManageEngine Information Disclosure in Multiple Products CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences