CVE-2021-31530

Vulnerability

CVE-2021-31530 is an information disclosure vulnerability in Zoho ManageEngine ServiceDesk Plus MSP prior to version 10522. The issue involves the exposure of sensitive global JavaScript variables that contain site, group, and technician mapping data. This affects all deployments running versions before 10522 [1].

Exploitation

An attacker with network access to the ServiceDesk Plus MSP web interface can exploit this vulnerability by inspecting the JavaScript variables exposed in the browser or through other client-side means. No authentication is required if the vulnerable variables are accessible on public-facing pages, though the exact attack vector is not detailed in the available references [1].

Impact

Successful exploitation allows an attacker to obtain sensitive information about site, group, and technician mappings within the ManageEngine environment. This information disclosure could aid in further targeted attacks or unauthorized access to the system [1].

Mitigation

The vulnerability is fixed in ServiceDesk Plus MSP build 10522, released on June 29, 2021. Users should upgrade to version 10522 or later as per the vendor release notes [1]. No workarounds are documented in the available references.