ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticating to the service and then sending a request specifying the password policy file of the other domain.
References
| Link | Resource |
|---|---|
| https://www.tenable.com/security/research/tra-2021-52 | Exploit Third Party Advisory |
| https://www.tenable.com/security/research/tra-2021-52 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.tenable.com/security/research/tra-2021-52 - Exploit, Third Party Advisory |
08 Aug 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-552 |
Information
Published : 2022-01-03 22:15
Updated : 2024-11-21 05:46
NVD link : CVE-2021-20148
Mitre link : CVE-2021-20148
CVE.ORG link : CVE-2021-20148
JSON object : View
Products Affected
zohocorp
- manageengine_adselfservice_plus
CWE
CWE-552
Files or Directories Accessible to External Parties