PT-2024-1577 · Zoho · Zoho Manageengine Adselfservice Plus

Joe Zhoy · Published 2024-01-11 · Updated 2024-06-07 · CVE-2024-0252

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions 6401 and below

Description The issue is related to the improper handling in the load balancer component of ManageEngine ADSelfService Plus, which can lead to remote code execution. Authentication is required to exploit this vulnerability. It is estimated that around 1,969 devices are potentially affected, mainly distributed in the United States, India, and other countries.

Recommendations For ManageEngine ADSelfService Plus versions 6401 and below, update to a version above 6401 to resolve the issue. As a temporary workaround, consider restricting access to the load balancer component until a patch is available. Avoid using the vulnerable load balancer component in the affected API endpoints until the issue is resolved.

Fix

RCE

Missing Authentication

Code Injection

Weakness Enumeration

CWE-306

CWE-94

Related Identifiers

BDU:2024-01138

CVE-2024-0252

Affected Products

Zoho Manageengine Adselfservice Plus

References · 20

• https://manageengine.com/products/self-service-password/advisory/CVE-2024-0252.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0252 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0252 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01138 · Security Note
• https://t.me/cvenotify/67014 · Telegram Post
• https://twitter.com/ksg93rd/status/1747091766279360955 · Twitter Post
• https://t.me/cvenotify/82257 · Telegram Post
• https://twitter.com/CVEnew/status/1745360523720565123 · Twitter Post
• https://twitter.com/TheHackForce/status/1747147545359339931 · Twitter Post
• https://twitter.com/pravin_karthik/status/1745808742132658241 · Twitter Post
• https://twitter.com/forsaken0129/status/1746845271311757561 · Twitter Post
• https://t.me/cvenotify/68068 · Telegram Post
• https://t.me/pentestingnews/42591 · Telegram Post
• https://t.me/cvenotify/67468 · Telegram Post
• https://twitter.com/akaclandestine/status/1748192108240928903 · Twitter Post