CVE-2018-5353
published 2020-09-30CVE-2018-5353: The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via…
PriorityP271critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
11.15%
95.8th percentile
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zohocorp | manageengine_adselfservice_plus | < 5.5 | 5.5 |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
| zohocorp | manageengine_adselfservice_plus | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Zoho ManageEngine ADSelfService Plus up to 5.5 GINA CP privileges management
vuldb·2026-07-05·CVSS 9.8
CVE-2018-5353 [CRITICAL] Zoho ManageEngine ADSelfService Plus up to 5.5 GINA CP privileges management
A vulnerability marked as critical has been reported in Zoho ManageEngine ADSelfService Plus up to 5.5. This impacts an unknown function of the component GINA CP Module. This manipulation causes improper privilege management.
This vulnerability is handled as CVE-2018-5353. The attack can be initiated remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
GHSA-p8cf-jjc3-phj5: The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5
ghsa_unreviewed·2022-05-24
CVE-2018-5353 [CRITICAL] GHSA-p8cf-jjc3-phj5: The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required
Red Hat
avahi: DNS amplification and reflection to spoofed addresses
vendor_redhat·2018-11-08·CVSS 9.1
CVE-2018-1000845 [CRITICAL] CWE-406 avahi: DNS amplification and reflection to spoofed addresses
avahi: DNS amplification and reflection to spoofed addresses
No description is available for this CVE.
Statement: This flaw was found to be a duplicate of CVE-2017-6519. Please see https://access.redhat.com/security/cve/CVE-2017-6519 for information about affected products and security errata.
Mitigation: Ensure UDP port 5353 is blocked in the firewall. Moreover, configure correctly the rate limiting options based on your needs (see ratelimit-interval-usec and ratelimit-burst options in /etc/avahi/avahi-daemon.conf).
Package: avahi (Red Hat Enterprise Linux 5) - Not affected
Package: avahi (Red Hat Enterprise Linux 6) - Not affected
Package: avahi (Red Hat Enterprise Linux 7) - Not affected
Package: avahi (Red Hat Enterprise Linux 8) - Not affected
Package: redhat-virtualization-ho
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-09-30
Published