Elevation of Privilege in ManageEngine ADSelfService Plus Product by ManageEngine

CVE-2020-11552

What is CVE-2020-11552?

An elevation of privilege vulnerability in ManageEngine ADSelfService Plus allows unauthenticated attackers to exploit insufficient enforcement of user privileges linked to a Certificate dialog. An attacker with physical access to the Windows host can trigger this vulnerability by introducing a self-signed SSL certificate, enabling privilege escalation to SYSTEM. By exploiting the self-service option on the Windows login screen, the thick-client software connects to a remote ADSelfService Plus server, facilitating the launch of Explorer with elevated privileges, leading to potential unauthorized access and control over the system.

References