PT-2015-2914 · Lepide · Lepide Active Directory Self Service

Alain Homewood · Published 2015-12-08 · Updated 2016-11-28 · CVE-2015-8570

Positive Technologies (AI Summary)

CVSS v2.0

7.4

High

Base vector

AV:A/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lepide Active Directory Self Service (affected versions not specified)

Description The issue is related to errors in the implementation of the password reset functionality in Lepide Active Directory Self Service. This allows remote authenticated users to change arbitrary domain user passwords via a crafted request. The exploitation of this issue may enable an attacker to modify passwords of arbitrary users using a specially crafted request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2016-00011

CVE-2015-8570

ZDI-15-621

Affected Products

Lepide Active Directory Self Service

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-8570 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-621 · Security Note
• https://bdu.fstec.ru/vul/2016-00011 · Security Note
• http://securityfocus.com/bid/78729 · Note
• http://zerodayinitiative.com/advisories/ZDI-15-621 · Note