CSV Injection Vulnerability in ManageEngine ADSelfService Plus
CVE-2021-33256

8.8HIGH

Key Information:

Vendor

Zohocorp
Status
Manageengine Adselfservice Plus
Vendor
CVE Published:
9 August 2021

What is CVE-2021-33256?

An unauthenticated user can exploit a CSV injection vulnerability in the login panel of ManageEngine ADSelfService Plus (Version 6.1 Build No: 6101). By manipulating the j_username parameter, an attacker could potentially gain access to sensitive information if a privileged user exports the 'User Attempts Audit Report' as a CSV file, enabling the possibility of initiating a reverse shell. Although the vendor disputes the validity of this vulnerability, it raises significant concerns about user data security and potential unauthorized access.

References

https://docs.unsafe-inline.com/0day/manageengine-adselfse...
x_refsource_MISC

EPSS Score

16% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.