PT-2021-20095 · Manageengine · Zoho Manageengine Adselfservice Plus

Published 2021-08-09 · Updated 2024-08-04 · CVE-2021-33256

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus version 6.1 Build No: 6101

Description A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus can be exploited by an unauthenticated user. The j username parameter seems to be vulnerable, and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Report" as a CSV file. The vendor disputes this issue, claiming it is not a valid vulnerability in their product.

Recommendations For ManageEngine ADSelfService Plus version 6.1 Build No: 6101, consider disabling the export of "User Attempts Audit Report" as a CSV file to minimize the risk of exploitation. Restrict access to the login panel to reduce the potential for unauthenticated users to exploit the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2021-33256

Affected Products

Zoho Manageengine Adselfservice Plus

References · 5

• 🔥 https://docs.unsafe-inline.com/0day/manageengine-adselfservice-plus-6.1-csv-injection · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33256 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33256 · Vendor Advisory
• https://t.me/cvenotify/88866 · Telegram Post
• https://t.me/cibsecurity/27017 · Telegram Post