8.1
CVE-2025-1723
- EPSS 1.42%
- Veröffentlicht 03.03.2025 08:15:15
- Zuletzt bearbeitet 30.09.2025 15:01:26
- Erkennungen
LoginAccount takeover
Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zohocorp ≫ Manageengine Adselfservice Plus Version < 6.5
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.5 Update 6500
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.5 Update 6501
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.5 Update 6502
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.5 Update 6503
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.5 Update 6504
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.5 Update 6505
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.5 Update 6506
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.5 Update 6507
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.5 Update 6508
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.5 Update 6509
Zohocorp ≫ Manageengine Adselfservice Plus Version 6.5 Update 6510
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.42% | 0.702 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 0fc0942c-577d-436f-ae8e-945763c79b02 | 8.1 | 2.8 | 5.2 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
|
CWE-287 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
https://www.manageengine.com/products/self-service-password/advisory/CVE-2025-1723.html