CVE-2021-27214

A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative interface via an HTTP request, a different vulnerability than CVE-2019-3905.

• CWE-79
• CWE-918

• https://www.horizonsecurity.it/lang_EN/advisories/?a=20&title=ManageEngine+ADSelfService+Plus+privilege+escalation++CVE202127214Exploit, Third Party Advisory
• https://www.manageengine.com/products/self-service-password/release-notes.htmlRelease Notes, Vendor Advisory
• https://www.horizonsecurity.it/lang_EN/advisories/?a=20&title=ManageEngine+ADSelfService+Plus+privilege+escalation++CVE202127214Exploit, Third Party Advisory
• https://www.manageengine.com/products/self-service-password/release-notes.htmlRelease Notes, Vendor Advisory

Published

Feb 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27208When booting a Zync-7000 SOC device from nand flash memory, …6.8
• CVE-2021-27209In the management interface on TP-Link Archer C5v 1.7_181221…7.1
• CVE-2021-27210TP-Link Archer C5v 1.7_181221 devices allows remote attacker…6.5
• CVE-2021-27211steghide 0.5.1 relies on a certain 32-bit seed value, which …7.5
• CVE-2021-27212In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an …7.5
• CVE-2021-27213config.py in pystemon before 2021-02-13 allows code executio…9.8
• CVE-2021-27215An issue was discovered in genua genugate before 9.0 Z p19, …9.8
• CVE-2021-27216Exim 4 before 4.94.2 has Execution with Unnecessary Privileg…6.3
• CVE-2021-27217An issue was discovered in the _send_secure_msg() function o…4.4
• CVE-2021-27218An issue was discovered in GNOME GLib before 2.66.7 and 2.67…7.5
• CVE-2021-27219An issue was discovered in GNOME GLib before 2.66.6 and 2.67…7.5
• CVE-2021-27220An issue was discovered in PRTG Network Monitor before 21.1.…5.3