9.8

CVE-2023-35854

Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update -
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6100
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6101
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6102
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6103
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6104
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6105
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6106
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6107
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6108
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6109
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6110
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6111
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.1 Update 6112
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 5.98% 0.924
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://www.manageengine.com
Product
https://github.com/970198175/Simply-use
Third Party Advisory