Lucene search

ManageEngineCVELIST:CVE-2024-0252

HistoryJan 11, 2024 - 7:57 a.m.

CVE-2024-0252 Remote code execution

2024-01-1107:57:12

CWE-94

ManageEngine

www.cve.org

cve

remote code execution

manageengine adselfservice plus

load balancer

authentication

vulnerability

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

47.0%

JSON

ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.

CNA Affected

[
  {
    "collectionURL": "https://www.manageengine.com/products/download.html",
    "defaultStatus": "affected",
    "platforms": [
      "Windows"
    ],
    "product": "ADSelfService Plus",
    "vendor": "ManageEngine",
    "versions": [
      {
        "lessThan": "6402",
        "status": "affected",
        "version": "0",
        "versionType": "6401"
      }
    ]
  }
]

References

www.manageengine.com/products/self-service-password/advisory/CVE-2024-0252.html

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

47.0%

JSON

Related for CVELIST:CVE-2024-0252