Vulnerability Description
ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Password Reset Portal used by the GINA client. The issue results from the lack of proper authentication of data received via HTTP. An attacker can leverage this vulnerability to bypass authentication and execute code in the context of SYSTEM. Was ZDI-CAN-17009.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | Manageengine Adselfservice Plus | 6.1 |
Related Weaknesses (CWE)
References
- https://www.manageengine.com/products/self-service-password/kb/our-response-to-C
- https://www.zerodayinitiative.com/advisories/ZDI-23-891Third Party AdvisoryVDB Entry
- https://www.manageengine.com/products/self-service-password/kb/our-response-to-C
- https://www.zerodayinitiative.com/advisories/ZDI-23-891Third Party AdvisoryVDB Entry
FAQ
What is CVE-2023-35719?
CVE-2023-35719 is a vulnerability with a CVSS score of 6.8 (MEDIUM). ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to execute arbitr...
How severe is CVE-2023-35719?
CVE-2023-35719 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-35719?
Check the references section above for vendor advisories and patch information. Affected products include: Zohocorp Manageengine Adselfservice Plus.