PT-2019-18444 · Zoho Manageengine · Adselfservice Plus

Dominique Righetto · Published 2019-03-18 · Updated 2021-07-21 · CVE-2019-7161

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions 5.x through build 5704

Description An issue was discovered where the software uses fixed ciphering keys to protect information. This gives an attacker the capacity to decipher any protected data.

Recommendations For versions 5.x through build 5704, update to a version later than build 5704 to resolve the issue.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-7161

Affected Products

Adselfservice Plus

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-7161 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7161 · Vendor Advisory
• https://manageengine.com/products/self-service-password/release-notes.html · Vendor Advisory
• https://excellium-services.com/cert-xlm-advisory/cve-2019-7161 · Note
• https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-7161 · Note
• https://excellium-services.com/cert-xlm-advisory · Note