Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability."
References
| Link | Resource |
|---|---|
| https://github.com/970198175/Simply-use | Third Party Advisory |
| https://www.manageengine.com | Product |
| https://github.com/970198175/Simply-use | Third Party Advisory |
| https://www.manageengine.com | Product |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/970198175/Simply-use - Third Party Advisory | |
| References | () https://www.manageengine.com - Product |
07 Nov 2023, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability." |
18 Jul 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | ** DISPUTED ** Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability." |
27 Jun 2023, 18:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/970198175/Simply-use - Third Party Advisory | |
| References | (MISC) https://www.manageengine.com - Product | |
| CPE | cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6107:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6111:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6110:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6112:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6109:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6108:*:*:*:*:*:* |
|
| CWE | CWE-306 | |
| First Time |
Zohocorp manageengine Adselfservice Plus
Zohocorp |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
20 Jun 2023, 13:03
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-20 12:15
Updated : 2024-11-21 08:08
NVD link : CVE-2023-35854
Mitre link : CVE-2023-35854
CVE.ORG link : CVE-2023-35854
JSON object : View
Products Affected
zohocorp
- manageengine_adselfservice_plus
CWE
CWE-306
Missing Authentication for Critical Function