CVE-2021-33617: Zohocorp ManageEngine Password Manager Pro

Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days.

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&userName= username enumeration, because the response (to a failed login request) is null only when the username is invalid.

Affected products

• Zohocorp ManageEngine Password Manager Pro: before 11.2 (fixed in 11.2); version 11.2 only

Published 2021-07-31. Last modified 2026-06-17.