Information Disclosure Vulnerability in Zoho ManageEngine ADSelfService Plus
CVE-2021-31874

5.9MEDIUM

Key Information:

Vendor

Zohocorp
Status
Manageengine Adselfservice Plus
Vendor
CVE Published:
2 July 2021

What is CVE-2021-31874?

Zoho ManageEngine ADSelfService Plus, prior to version 6104, is susceptible to an information disclosure vulnerability that may enable unauthorized users to access sensitive information from the password-sync database. This vulnerability can be exploited in rare scenarios, posing a risk to the confidentiality of password-related data, potentially leading to further attacks.

References

https://pitstop.manageengine.com/portal/en/community/topi...
x_refsource_MISC
https://blog.stmcyber.com/vulns/cve-2021-31874/
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.