ManageEngine ADSelfService Plus Authentication Bypass (CVE-2021-40539)

Description

ManageEngine ADSelfService Plus is a self-service password management and single sign-on solution for Active Directory and cloud applications.

ManageEngine ADSelfService Plus builds 6113 and below have an authentication bypass vulnerability in REST API. An unauthenticated attacker could exploit this vulnerability to take control of an affected system.

Remediation

Upgrade to the latest version of ManageEngine ADSelfService Plus

References

Related Vulnerabilities

Severity

High

Classification

CVE-2021-40539 CWE-287 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Authentication Bypass