CVE-2019-7161 — Hard-coded Credentials in Manageengine Adselfservice Plus

CWE-798 — Hard-coded Credentials3 documents3 sources
Severity
7.5HIGHNVD
EPSS
2.2%
top 15.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Zohocorp Manageengine Adselfservice Plus
Timeline
PublishedMar 21
Latest updateMay 13

Description

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

Patches

Patch: www.manageengine.com ↗Patch: www.manageengine.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-645f-643g-f2h4: An issue was discovered in Zoho ManageEngine ADSelfService Plus 5↗2022-05-13
▶
CVEList
CVE-2019-7161: An issue was discovered in Zoho ManageEngine ADSelfService Plus 5↗2019-03-18
▶
CVE-2019-7161 — Hard-coded Credentials | cvebase