PT-2023-13490 · Zoho · Zoho Manageengine Adselfservice Plus

Skay · Publicado 2023-03-23 · Atualizado 2023-03-30 · CVE-2022-36413

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions through 6203

Description The issue allows for a brute-force attack, leading to a password reset on IDM applications. This is a result of a weakness in the password reset mechanism, which can be exploited by an attacker to gain unauthorized access.

Recommendations For Zoho ManageEngine ADSelfService Plus versions through 6203, consider implementing additional security measures to prevent brute-force attacks, such as rate limiting or IP blocking, until a patch is available. As a temporary workaround, restrict access to the password reset feature to minimize the risk of exploitation.

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2022-36413

Produtos afetados

Zoho Manageengine Adselfservice Plus

Referências · 5

• https://manageengine.com/products/self-service-password/advisory/CVE-2022-36413.html · Aviso do Fabricante
• https://t.me/cvenotify/47171 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-36413 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-36413 · Aviso do Fabricante
• https://t.me/cibsecurity/60624 · Publicação no Telegram