CVE:CVE-2021-37415
CNNVD:CNNVD-202109-044
ZOHO ManageEngine ServiceDesk Plus（SDP）是美国卓豪（ZOHO）公司的一套基于ITIL架构的IT服务管理软件。该软件集成了事件管理、问题管理、资产管理IT项目管理、采购与合同管理等功能模块。
Zoho ManageEngine ServiceDesk Plus 存在访问控制错误漏洞，该漏洞源于产品中的一些API缺少验证限制。攻击者可通过该漏洞在没有鉴权的情况下访问敏感链接。以下产品及版本受到影响：Zoho ManageEngine ServiceDesk Plus 11302 之前版本。
solution:Upgrade zohocorp manageengine_servicedesk_plus to a higher version than 11.0:11005,11.0:11006,11.0:11007,11.0:11008,11.0:11009,11.0:11010,11.0:11011,11.1,11.1:11100,11.1:11101,11.1:11102,11.1:11103,11.1:11104,11.1:11105,11.1:11106,11.1:11107,11.1:11108,11.1:11109,11.1:11110,11.1:11111,11.1:11112,11.1:11113,11.1:11114,11.1:11115,11.1:11116,11.1:11117,11.1:11118,11.1:11119,11.1:11120,11.1:11121,11.1:11122,11.1:11123,11.1:11124,11.1:11125,11.1:11126,11.1:11127,11.1:11128,11.1:11129,11.1:11130,11.1:11131,11.1:11132,11.1:11133,11.1:11134,11.1:11135,11.1:11136,11.1:11137,11.1:11138,11.1:11139,11.1:11140,11.1:11141,11.1:11142,11.1:11143,11.1:11144,11.2,11.2:11200,11.2:11201,11.2:11202,11.2:11203,11.2:11204,11.2:11205,11.2:11206,11.2:11207,11.3,11.3:11300,11.3:11301,and avoid the version 11.0:11005,11.0:11006,11.0:11007,11.0:11008,11.0:11009,11.0:11010,11.0:11011,11.1,11.1:11100,11.1:11101,11.1:11102,11.1:11103,11.1:11104,11.1:11105,11.1:11106,11.1:11107,11.1:11108,11.1:11109,11.1:11110,11.1:11111,11.1:11112,11.1:11113,11.1:11114,11.1:11115,11.1:11116,11.1:11117,11.1:11118,11.1:11119,11.1:11120,11.1:11121,11.1:11122,11.1:11123,11.1:11124,11.1:11125,11.1:11126,11.1:11127,11.1:11128,11.1:11129,11.1:11130,11.1:11131,11.1:11132,11.1:11133,11.1:11134,11.1:11135,11.1:11136,11.1:11137,11.1:11138,11.1:11139,11.1:11140,11.1:11141,11.1:11142,11.1:11143,11.1:11144,11.2,11.2:11200,11.2:11201,11.2:11202,11.2:11203,11.2:11204,11.2:11205,11.2:11206,11.2:11207,11.3,11.3:11300,11.3:11301