Actively exploited in the wild
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
Zoho - ManageEngine · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-40539
CriticalCVSS 9.8KEVSummary
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
Risk Assessment
An unauthenticated attacker can take control of the ADSelfService Plus server, potentially compromising data confidentiality and integrity and enabling further attacks on the infrastructure.
Recommendation
It is recommended to immediately update to the latest available version of ADSelfService Plus that includes a fix for this vulnerability.
Other vulnerabilities in Zoho ManageEngine ADSelfService Plus
See all- CVE-2023-35854Critical
Zoho ManageEngine ADSelfService Plus through version 6113 has an authentication bypass vulnerability that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving domain controller administrator privileges.
- CVE-2018-5353Critical
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before version 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window, enabling an unauthenticated attacker to redirect the browser and gain execution in the context of the WinLogon.exe process.
Original NVD description (English source)
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.