PT-2021-21648 · Manageengine · Zoho Manageengine Adselfservice Plus

Published 2021-09-21 · Updated 2022-07-12 · CVE-2021-37424

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to 6112

Description The issue allows for domain user account takeover.

Recommendations For versions prior to 6112, update to version 6112 or later to resolve the issue.

Fix

Related Identifiers

CVE-2021-37424

Affected Products

Zoho Manageengine Adselfservice Plus

References · 5

• https://osv.dev/vulnerability/CVE-2021-37424 · Vendor Advisory
• https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6112-hotfix-release · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37424 · Security Note
• https://manageengine.com · Vendor Advisory
• https://t.me/cibsecurity/29178 · Telegram Post