PT-2023-25291 · Zoho · Zoho Manageengine Adselfservice Plus

Ashley King + 3 · Publicado 2023-06-21 · Atualizado 2023-09-11 · CVE-2023-35719

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus (affected versions not specified)

Description This issue allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this issue. The specific flaw exists within the Password Reset Portal used by the GINA client, resulting from the lack of proper authentication of data received via HTTP. An attacker can leverage this issue to bypass authentication and execute code in the context of SYSTEM.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2023-35719

ZDI-23-891

Produtos afetados

Zoho Manageengine Adselfservice Plus

Referências · 8

• https://manageengine.com/products/self-service-password/kb/our-response-to-CVE-2023-35719.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-35719 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-35719 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-23-891 · Nota de Segurança
• https://t.me/cibsecurity/69977 · Publicação no Telegram
• https://t.me/cvenotify/57978 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1699374445335314927 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1699280801035092237 · Publicação no Twitter