PT-2023-13490 · Zoho · Zoho Manageengine Adselfservice Plus

Skay · Published 2023-03-23 · Updated 2023-03-30 · CVE-2022-36413

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions through 6203

Description The issue allows for a brute-force attack, leading to a password reset on IDM applications. This is a result of a weakness in the password reset mechanism, which can be exploited by an attacker to gain unauthorized access.

Recommendations For Zoho ManageEngine ADSelfService Plus versions through 6203, consider implementing additional security measures to prevent brute-force attacks, such as rate limiting or IP blocking, until a patch is available. As a temporary workaround, restrict access to the password reset feature to minimize the risk of exploitation.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2022-36413

Affected Products

Zoho Manageengine Adselfservice Plus

References · 5

• https://manageengine.com/products/self-service-password/advisory/CVE-2022-36413.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36413 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36413 · Vendor Advisory
• https://t.me/cvenotify/47171 · Telegram Post
• https://t.me/cibsecurity/60624 · Telegram Post