Zoho Corp Manageengine Adselfservice Plus
By the Year
In 2023 there have been 1 vulnerability in Zoho Corp Manageengine Adselfservice Plus with an average score of 9.8 out of ten. Last year Manageengine Adselfservice Plus had 7 security vulnerabilities published. Right now, Manageengine Adselfservice Plus is on track to have less security vulnerabilities in 2023 than it did last year. However, the average CVE base score of the vulnerabilities in 2023 is greater by 3.50.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2023 | 1 | 9.80 |
| 2022 | 7 | 6.30 |
| 2021 | 12 | 8.47 |
| 2020 | 3 | 9.80 |
| 2019 | 9 | 7.87 |
| 2018 | 2 | 6.10 |
It may take a day or so for new Manageengine Adselfservice Plus vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Zoho Corp Manageengine Adselfservice Plus Security Vulnerabilities
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in
CVE-2022-47966
9.8 - Critical
- January 18, 2023
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections.
Zoho ManageEngine ADSelfService Plus before 6203
CVE-2022-34829
7.5 - High
- July 04, 2022
Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload to the Mobile App Deployment API.
Zoho ManageEngine ADSelfService Plus before 6202
CVE-2022-28987
5.3 - Medium
- May 20, 2022
Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.
Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131
CVE-2022-29457
8.8 - High
- April 18, 2022
Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.
Insufficiently Protected Credentials
Zoho ManageEngine ADSelfService Plus before build 6122
CVE-2022-28810
6.8 - Medium
- April 18, 2022
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.
Shell injection
Zoho ManageEngine ADSelfService Plus before 6121
CVE-2022-24681
6.1 - Medium
- April 07, 2022
Zoho ManageEngine ADSelfService Plus before 6121 allows XSS via the welcome name attribute to the Reset Password, Unlock Account, or User Must Change Password screen.
XSS
ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI
CVE-2021-20147
5.3 - Medium
- January 03, 2022
ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.
Side Channel Attack
ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name
CVE-2021-20148
4.3 - Medium
- January 03, 2022
ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticating to the service and then sending a request specifying the password policy file of the other domain.
Information Disclosure
Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.
CVE-2021-37422
9.8 - Critical
- September 10, 2021
Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.
SQL Injection
Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.
CVE-2021-37423
9.8 - Critical
- September 10, 2021
Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
CVE-2021-40539
9.8 - Critical
- September 07, 2021
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
authentification
Zoho ManageEngine ADSelfService Plus through 6102
CVE-2021-33055
9.8 - Critical
- August 30, 2021
Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.
Shell injection
Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.
CVE-2021-37416
6.1 - Medium
- August 30, 2021
Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.
XSS
Zoho ManageEngine ADSelfService Plus version 6103 and prior
CVE-2021-37417
9.8 - Critical
- August 30, 2021
Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.
authentification
Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.
CVE-2021-37421
9.8 - Critical
- August 30, 2021
Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.
Insufficient Verification of Data Authenticity
** DISPUTED ** A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101
CVE-2021-33256
8.8 - High
- August 09, 2021
** DISPUTED ** A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The j_username parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Report" as CSV file. Note: The vendor disputes this vulnerability, claiming "This is not a valid vulnerability in our ADSSP product. We don't see this as a security issue at our side."
CSV Injection
Zoho ManageEngine ADSelfService Plus before 6104, in rare situations
CVE-2021-31874
5.9 - Medium
- July 02, 2021
Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application.
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
CVE-2021-28958
9.8 - Critical
- June 25, 2021
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
Shell injection
Zoho ManageEngine ADSelfService Plus before 6104
CVE-2021-27956
6.1 - Medium
- May 20, 2021
Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field.
XSS
A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013
CVE-2021-27214
6.1 - Medium
- February 19, 2021
A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative interface via an HTTP request, a different vulnerability than CVE-2019-3905.
XSS
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510
CVE-2020-24786
9.8 - Critical
- August 31, 2020
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus before build number 5817, DataSecurity Plus before build number 6033, RecoverManager Plus before build number 6017, EventLog Analyzer before build number 12136, ADAudit Plus before build number 6052, O365 Manager Plus before build number 4334, Cloud Security Plus before build number 4110, ADManager Plus before build number 7055, and Log360 before build number 5166. The remotely accessible Java servlet com.manageengine.ads.fw.servlet.UpdateProductDetails is prone to an authentication bypass. System integration properties can be modified and lead to full ManageEngine suite compromise.
authentification
An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003
CVE-2020-11552
9.8 - Critical
- August 11, 2020
An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An attacker does not require any privilege on the target system in order to exploit this vulnerability. One option is the self-service option on the Windows login screen. Upon selecting this option, the thick-client software is launched, which connects to a remote ADSelfService Plus server to facilitate self-service operations. An unauthenticated attacker having physical access to the host could trigger a security alert by supplying a self-signed SSL certificate to the client. The View Certificate option from the security alert allows an attacker to export a displayed certificate to a file. This can further cascade to a dialog that can open Explorer as SYSTEM. By navigating from Explorer to \windows\system32, cmd.exe can be launched as a SYSTEM.
Improper Privilege Management
Zoho ManageEngine ADSelfService Plus before 5815
CVE-2020-11518
9.8 - Critical
- April 04, 2020
Zoho ManageEngine ADSelfService Plus before 5815 allows unauthenticated remote code execution.
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607
CVE-2019-7162
9.1 - Critical
- December 31, 2019
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation.
An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809
CVE-2019-18781
6.1 - Medium
- December 18, 2019
An open redirect vulnerability was discovered in Zoho ManageEngine ADSelfService Plus 5.x before 5809 that allows attackers to force users who click on a crafted link to be sent to a specified external site.
Open Redirect
Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page
CVE-2019-18411
8.8 - High
- November 06, 2019
Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own.
Session Riding
Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation
CVE-2019-12876
7.3 - High
- July 17, 2019
Zoho ManageEngine ADManager Plus 6.6.5, ADSelfService Plus 5.7, and DesktopCentral 10.0.380 have Insecure Permissions, leading to Privilege Escalation from low level privileges to System.
Incorrect Permission Assignment for Critical Resource
In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability
CVE-2019-8346
6.1 - Medium
- May 24, 2019
In Zoho ManageEngine ADSelfService Plus 5.x through 5704, an authorization.do cross-site Scripting (XSS) vulnerability allows for an unauthenticated manipulation of the JavaScript code by injecting the HTTP form parameter adscsrf. An attacker can use this to capture a user's AD self-service password reset and MFA token.
XSS
Zoho ManageEngine ADSelfService Plus before build 5708 has XSS
CVE-2019-11511
6.1 - Medium
- April 25, 2019
Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.
XSS
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704
CVE-2019-7161
7.5 - High
- March 21, 2019
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.
Inadequate Encryption Strength
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE
CVE-2018-20664
9.8 - Critical
- January 03, 2019
Zoho ManageEngine ADSelfService Plus 5.x before build 5701 has XXE via an uploaded product license.
XXE
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.
CVE-2019-3905
10 - Critical
- January 03, 2019
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.
XSPA
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
CVE-2018-20485
6.1 - Medium
- December 26, 2018
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the employee search feature.
XSS
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.
CVE-2018-20484
6.1 - Medium
- December 26, 2018
Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.
XSS
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Zoho Corp Manageengine Adselfservice Plus or by Zoho Corp? Click the Watch button to subscribe.
