Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2022-28987

5 documents5 sources

Severity

5.3MEDIUM

EPSS

11.2%

top 6.51%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Zohocorp Manageengine Adselfservice Plus

Timeline

PublishedMay 20

Latest updateMay 21

Description

Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages1 packages

▶NVDzohocorp/manageengine_adselfservice_plus6.1

🔴Vulnerability Details

GHSA

GHSA-wf45-x487-v279: ManageEngine ADSelfService Plus v6↗2022-05-21

▶

CVEList

CVE-2022-28987: Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/l↗2022-05-20

▶

VulnCheck

Zoho ManageEngine ADSelfService Plus Username Enumeration↗2022

▶

💥Exploits & PoCs

Nuclei

Zoho ManageEngine ADSelfService Plus 6121 - Username Enumeration

▶