PT-2022-9167 · Manageengine · Zoho Manageengine Adselfservice Plus

Published 2022-01-03 · Updated 2022-01-13 · CVE-2021-20147

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to build 6116

Description The issue allows an unauthenticated remote attacker to determine whether a Windows domain user exists due to an observable response discrepancy in the UMCP operation of the ChangePasswordAPI.

Recommendations For versions prior to build 6116, update to build 6116 or later to resolve the issue. As a temporary workaround, consider restricting access to the ChangePasswordAPI to minimize the risk of exploitation.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2021-20147

Affected Products

Zoho Manageengine Adselfservice Plus

References · 5

• 🔥 https://tenable.com/security/research/tra-2021-52 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-20147 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20147 · Vendor Advisory
• https://t.me/cibsecurity/34888 · Telegram Post
• https://t.me/cvenotify/25406 · Telegram Post