CVE-2021-28958 — OS Command Injection in Manageengine Adselfservice Plus

CWE-78 — OS Command Injection CWE-287 — Improper Authentication3 documents3 sources

Severity

9.8CRITICALNVD

EPSS

55.3%

top 1.92%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Zohocorp Manageengine Adselfservice Plus

Timeline

PublishedJun 25

Latest updateMay 24

Description

Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

▶NVDzohocorp/manageengine_adselfservice_plus13 versions+12

🔴Vulnerability Details

GHSA

GHSA-4j38-964f-658r: Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password↗2022-05-24

▶

CVEList

CVE-2021-28958: Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password↗2021-06-25

▶