Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-40493: Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API.

CVE-2021-40493 · published 5 years ago

Summary

Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API.

What to do

Update zohocorp manageengine_opmanager to version 12.5 or later.

Affected software

Vendor	Product	Affected versions
zohocorp	manageengine_opmanager	< 12.5 12.5 `cpe:2.3:a:zohocorp:manageengine_opmanager::::::::`

Original advisory text

Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. This occurs via the pollingObject parameter of the getDataCollectionFailureReason API.

References

https://www.manageengine.com/network-monitoring/security-updates/cve-2021-40493.... Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

50% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published13 Oct 2021

Updated29 Sep 2026

First seen29 Sep 2026

Sources

CVE-2021-40493 · NVD

Track software like this

Free during beta