Описание
An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboard input.
Ссылки
- Broken Link
- ExploitThird Party Advisory
- Broken Link
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 4.3.3 (включая) до 5.0.6 (исключая)
Одновременно
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
EPSS
Процентиль: 79%
0.01223
Низкий
6.8 Medium
CVSS3
7.2 High
CVSS2
Дефекты
CWE-640
Связанные уязвимости
github
больше 3 лет назад
An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboard input.
EPSS
Процентиль: 79%
0.01223
Низкий
6.8 Medium
CVSS3
7.2 High
CVSS2
Дефекты
CWE-640