Zoho ManageEngine ADSelfService Plus vulnerabilities
3 known CVE vulnerabilities in Zoho ManageEngine ADSelfService Plus, translated and rated.
- CVE-2023-35854Critical
Zoho ManageEngine ADSelfService Plus through version 6113 has an authentication bypass vulnerability that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving domain controller administrator privileges.
- CVE-2021-40539CriticalActively exploited
Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execution.
- CVE-2018-5353Critical
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before version 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window, enabling an unauthenticated attacker to redirect the browser and gain execution in the context of the WinLogon.exe process.