PT-2019-18444 · Zoho Manageengine · Adselfservice Plus

Dominique Righetto · Publicado 2019-03-18 · Atualizado 2021-07-21 · CVE-2019-7161

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 5.x through build 5704

Description An issue was discovered where the software uses fixed ciphering keys to protect information. This gives an attacker the capacity to decipher any protected data.

Recommendations For versions 5.x through build 5704, update to a version later than build 5704 to resolve the issue.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2019-7161

Produtos afetados

Adselfservice Plus

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-7161 · Nota de Segurança
• https://excellium-services.com/cert-xlm-advisory/cve-2019-7161 · Nota
• https://osv.dev/vulnerability/CVE-2019-7161 · Aviso do Fabricante
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-7161 · Nota
• https://manageengine.com/products/self-service-password/release-notes.html · Aviso do Fabricante
• https://excellium-services.com/cert-xlm-advisory · Nota