CVE-2021-42956
- State
- Published
- Severity
- 7.8 High
- Published
- Nov 17, 2021
- Updated
- Aug 4, 2024
- Reserved
- Oct 25, 2021
Description
Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. Due to improper privilege management, the process launches as the logged in user, so memory dump can be done by non-admin also. Remotely, an attacker can dump all sensitive information including DB Connection string, entire IT infrastructure details, commands executed by IT admin including credentials, secrets, private keys and more.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.8 High | CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N | mitre |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.