PT-2020-12661 · Manageengine · Zoho Manageengine Adselfservice Plus

Published 2020-04-04 · Updated 2020-08-13 · CVE-2020-11518

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to 5815

Description The issue allows unauthenticated remote code execution. There have been reports of real-world incidents where this issue was exploited, including a case where an individual bruteforced their way into an Active Directory.

Recommendations For versions prior to 5815, update to version 5815 or later to resolve the issue. As a temporary workaround, consider restricting access to the application to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2020-11518

Affected Products

Zoho Manageengine Adselfservice Plus

References · 8

• https://pitstop.manageengine.com/portal/community/topic/adselfservice-plus-5815-released-with-an-important-security-fix · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11518 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11518 · Vendor Advisory
• https://t.me/canyoupwnme/6574 · Telegram Post
• https://t.me/cybersecuritytechnologies/1576 · Telegram Post
• https://t.me/ckure/5204 · Telegram Post
• https://t.me/rnetsec/13078 · Telegram Post
• https://t.me/defcon_news/54413 · Telegram Post