8.8

CVE-2019-18411

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5000
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5001
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5002
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5010
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5011
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5020
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5021
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5022
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5030
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5032
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5040
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.0 Update 5041
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5100
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5101
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5102
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5103
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5104
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5105
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5106
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5107
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5108
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5109
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5110
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5111
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5112
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5113
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5114
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.1 Update 5115
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5200
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5201
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5202
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5203
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5204
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5205
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5206
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.2 Update 5207
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5300
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5301
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5302
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5303
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5304
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5305
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5306
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5307
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5308
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5309
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5310
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5311
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5312
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5313
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5314
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5315
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5316
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5317
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5318
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5319
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5320
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5321
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5322
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5323
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5324
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5325
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5326
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5327
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5328
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5329
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.3 Update 5330
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.4 Update 5400
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5500
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5501
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5502
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5503
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5504
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5505
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5506
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5507
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5508
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5509
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5510
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5511
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5512
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5513
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5514
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5515
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5516
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5517
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5518
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5519
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5520
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.5 Update 5521
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5600
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5601
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5602
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5603
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5604
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5605
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5606
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.6 Update 5607
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.7 Update 5702
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.7 Update 5704
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.7 Update 5705
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.7 Update 5706
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.7 Update 5707
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.7 Update 5708
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.7 Update 5709
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.7 Update 5710
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5800
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5801
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5802
Zohocorp ≫ Manageengine Adselfservice Plus Version 5.8 Update 5803
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.34% 0.814
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://gist.github.com/aliceicl/e32fb4a17277c7db9e0256185ac03dae
Third Party Advisory