Lucene search

ManageEngineCVE-2024-0252

HistoryJan 11, 2024 - 8:15 a.m.

CVE-2024-0252

2024-01-1108:15:35

CWE-94

ManageEngine

web.nvd.nist.gov

manageengine

adselfservice plus

cve-2024-0252

remote code execution

vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

47.0%

JSON

ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.

Affected configurations

Nvd

Node

zohocorpmanageengine_adselfservice_plusRange<6.4

zohocorpmanageengine_adselfservice_plusMatch6.46400

zohocorpmanageengine_adselfservice_plusMatch6.46401

VendorProductVersionCPE
zohocorpmanageengine_adselfservice_plus*cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*
zohocorpmanageengine_adselfservice_plus6.4cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.4:6400:*:*:*:*:*:*
zohocorpmanageengine_adselfservice_plus6.4cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.4:6401:*:*:*:*:*:*

Vendor	Product	Version	CPE
zohocorp	manageengine_adselfservice_plus	*	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus::::::::
zohocorp	manageengine_adselfservice_plus	6.4	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.4:6400::::::
zohocorp	manageengine_adselfservice_plus	6.4	cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.4:6401::::::

CNA Affected

[
  {
    "collectionURL": "https://www.manageengine.com/products/download.html",
    "defaultStatus": "affected",
    "platforms": [
      "Windows"
    ],
    "product": "ADSelfService Plus",
    "vendor": "ManageEngine",
    "versions": [
      {
        "lessThan": "6402",
        "status": "affected",
        "version": "0",
        "versionType": "6401"
      }
    ]
  }
]

References

www.manageengine.com/products/self-service-password/advisory/CVE-2024-0252.html

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

47.0%

JSON

Related for CVE-2024-0252