Description

ManageEngine ADSelfService Plus is a self-service password management and single sign-on solution for Active Directory and cloud applications.

ManageEngine ADSelfService Plus builds 6113 and below have an authentication bypass vulnerability in REST API. An unauthenticated attacker could exploit this vulnerability to take control of an affected system.

Remediation

Upgrade to the latest version of ManageEngine ADSelfService Plus

References

Security Advisory - CVE-2021-40539

Related Vulnerabilities

WordPress Plugin Authorize.net Payment Gateway For WooCommerce Security Bypass (2.0)

WordPress Plugin Data Tables Generator by Supsystic Security Bypass (1.10.25)

WordPress Plugin Contact Form Builder-a plugin for creating contact and feedback forms Security Bypass (1.0.7)

Drupal Core 8.x Security Bypass (8.0.0 - 8.1.6)

WordPress Plugin Events Widgets For Elementor And The Events Calendar Security Bypass (1.4.3)

Severity

High

Classification

CVE-2021-40539 CWE-287 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Authentication Bypass