PT-2025-9278 · Manageengine · Zoho Manageengine Adselfservice Plus
Weston
·
Published
2025-02-26
·
Updated
2025-05-02
·
CVE-2025-1723
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Zohocorp ManageEngine ADSelfService Plus versions 6510 and below
Description
The issue is related to session mishandling, which can lead to account takeover. Valid account holders in the setup only have the potential to exploit this bug. The vulnerability allows attackers to bypass authentication safeguards and intercept sensitive user enrollment data when MFA is disabled. This creates a significant risk, potentially allowing malicious actors to impersonate legitimate users and take over accounts. The estimated number of potentially affected devices worldwide is not explicitly mentioned, but over 13,100 services have been found to be vulnerable.
Recommendations
For versions 6510 and below, update to the patched build 6511 to secure sensitive data. As a precaution, enforce MFA for all administrative and user accounts. Consider temporarily disabling the vulnerable session management feature until a patch is available. Restrict access to sensitive user enrollment data to minimize the risk of exploitation. Avoid using the affected ADSelfService Plus software until the issue is resolved.
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Zoho Manageengine Adselfservice Plus