Описание
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2021-40539
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40539
- https://www.manageengine.com
- https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
- http://packetstormsecurity.com/files/165085/ManageEngine-ADSelfService-Plus-Authentication-Bypass-Code-Execution.html
Связанные уязвимости
CVSS3: 9.8
nvd
больше 4 лет назад
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
CVSS3: 9.8
fstec
больше 4 лет назад
Уязвимость программного обеспечения для сброса паролей ManageEngine ADSelfService Plus , связанная с отсутствием процедуры аутентификации, позволяющая нарушителю обойти процедуру аутентификации