PT-2023-25291 · Zoho · Zoho Manageengine Adselfservice Plus

Ashley King + 3 · Published 2023-06-21 · Updated 2023-09-11 · CVE-2023-35719

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus (affected versions not specified)

Description This issue allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this issue. The specific flaw exists within the Password Reset Portal used by the GINA client, resulting from the lack of proper authentication of data received via HTTP. An attacker can leverage this issue to bypass authentication and execute code in the context of SYSTEM.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2023-35719

ZDI-23-891

Affected Products

Zoho Manageengine Adselfservice Plus

References · 8

• https://manageengine.com/products/self-service-password/kb/our-response-to-CVE-2023-35719.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35719 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35719 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-891 · Security Note
• https://t.me/cibsecurity/69977 · Telegram Post
• https://t.me/cvenotify/57978 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1699374445335314927 · Twitter Post
• https://twitter.com/CVEnew/status/1699280801035092237 · Twitter Post