Zoho Corp Manageengine Adselfservice Plus

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed

CVE-2023-6105 5.5 - Medium - November 15, 2023

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database passwords. This allows the user to access the ManageEngine product database.

ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability

CVE-2023-35719 6.8 - Medium - September 06, 2023

ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Password Reset Portal used by the GINA client. The issue results from the lack of proper authentication of data received via HTTP. An attacker can leverage this vulnerability to bypass authentication and execute code in the context of SYSTEM. Was ZDI-CAN-17009.

Insufficient Verification of Data Authenticity

** DISPUTED ** Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass

CVE-2023-35854 9.8 - Critical - June 20, 2023

** DISPUTED ** Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability."

Missing Authentication for Critical Function

Zoho ManageEngine ADSelfService Plus before 6218

CVE-2023-28342 7.5 - High - April 05, 2023

Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.

Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack

CVE-2022-36413 9.1 - Critical - March 23, 2023

Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications.

Improper Restriction of Excessive Authentication Attempts

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in

CVE-2022-47966 9.8 - Critical - January 18, 2023

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Zoho ManageEngine ADSelfService Plus before 6203

CVE-2022-34829 7.5 - High - July 04, 2022

Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API.

Zoho ManageEngine ADSelfService Plus before 6202

CVE-2022-28987 5.3 - Medium - May 20, 2022

Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.

Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131

CVE-2022-29457 8.8 - High - April 18, 2022

Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.

Insufficiently Protected Credentials

Zoho ManageEngine ADSelfService Plus before build 6122

CVE-2022-28810 6.8 - Medium - April 18, 2022

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.

Shell injection

Zoho ManageEngine ADSelfService Plus before 6121

CVE-2022-24681 6.1 - Medium - April 07, 2022

Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.

XSS

ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name

CVE-2021-20148 4.3 - Medium - January 03, 2022

ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticating to the service and then sending a request specifying the password policy file of the other domain.

Files or Directories Accessible to External Parties

ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI

CVE-2021-20147 5.3 - Medium - January 03, 2022

ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.

Side Channel Attack

Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.

CVE-2021-37422 9.8 - Critical - September 10, 2021

Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.

SQL Injection

Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.

CVE-2021-37423 9.8 - Critical - September 10, 2021

Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

CVE-2021-40539 9.8 - Critical - September 07, 2021

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.

Use of Incorrectly-Resolved Name or Reference

Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.

CVE-2021-37421 9.8 - Critical - August 30, 2021

Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.

Insufficient Verification of Data Authenticity

Zoho ManageEngine ADSelfService Plus through 6102

CVE-2021-33055 9.8 - Critical - August 30, 2021

Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.

Shell injection

Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.

CVE-2021-37416 6.1 - Medium - August 30, 2021

Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.

XSS

Zoho ManageEngine ADSelfService Plus version 6103 and prior

CVE-2021-37417 9.8 - Critical - August 30, 2021

Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.

authentification

** DISPUTED ** A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101

CVE-2021-33256 8.8 - High - August 09, 2021

** DISPUTED ** A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Report" as CSV file. Note: The vendor disputes this vulnerability, claiming "This is not a valid vulnerability in our ADSSP product. We don't see this as a security issue at our side."

CSV Injection

Zoho ManageEngine ADSelfService Plus before 6104, in rare situations

CVE-2021-31874 5.9 - Medium - July 02, 2021

Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application.

Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.

CVE-2021-28958 9.8 - Critical - June 25, 2021

Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.

Shell injection

Zoho ManageEngine ADSelfService Plus before 6104

CVE-2021-27956 6.1 - Medium - May 20, 2021

Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field.

XSS

A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013

CVE-2021-27214 6.1 - Medium - February 19, 2021

A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative interface via an HTTP request, a different vulnerability than CVE-2019-3905.

XSS

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510

CVE-2020-24786 9.8 - Critical - August 31, 2020

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.

authentification

An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003

CVE-2020-11552 9.8 - Critical - August 11, 2020

An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An attacker does not require any privilege on the target system in order to exploit this vulnerability. One option is the self-service option on the Windows login screen. Upon selecting this option, the thick-client software is launched, which connects to a remote ADSelfService Plus server to facilitate self-service operations. An unauthenticated attacker having physical access to the host could trigger a security alert by supplying a self-signed SSL certificate to the client. The View Certificate option from the security alert allows an attacker to export a displayed certificate to a file. This can further cascade to a dialog that can open Explorer as SYSTEM. By navigating from Explorer to \windows\system32, cmd.exe can be launched as a SYSTEM.

Improper Privilege Management

Zoho ManageEngine ADSelfService Plus before 5815

CVE-2020-11518 9.8 - Critical - April 04, 2020

Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution.

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607

CVE-2019-7162 9.1 - Critical - December 31, 2019

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation.

An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809

CVE-2019-18781 6.1 - Medium - December 18, 2019

An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified external site.

Open Redirect

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page

CVE-2019-18411 8.8 - High - November 06, 2019

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own.

Session Riding

Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation

CVE-2019-12876 7.3 - High - July 17, 2019

Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System.

Incorrect Permission Assignment for Critical Resource

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability

CVE-2019-8346 6.1 - Medium - May 24, 2019

In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token.

XSS

Zoho ManageEngine ADSelfService Plus before build 5708 has XSS

CVE-2019-11511 6.1 - Medium - April 25, 2019

Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.

XSS

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704

CVE-2019-7161 7.5 - High - March 21, 2019

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.

Inadequate Encryption Strength

Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE

CVE-2018-20664 9.8 - Critical - January 03, 2019

Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.

XXE

Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.

CVE-2019-3905 10 - Critical - January 03, 2019

Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.

XSPA

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.

CVE-2018-20485 6.1 - Medium - December 26, 2018

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.

XSS

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.

CVE-2018-20484 6.1 - Medium - December 26, 2018

Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.

XSS