CVE-2010-3272

ManageEngine ADSelfService Plus 4.4 - POST Manipulation Security Question

Severity Score

9.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified (1) Hide_Captcha or (2) quesList parameter in a validateAll action.

accounts/ValidateAnswers en la implementación de seguridad-preguntas en Zoho ManageEngine ADSelfService Plus anterior a v4.5 Build 4500 facilita a los atacantes remotos restablecer las contraseñas de usuario, y en consecuencia obtener acceso a cuentas de usuario arbitrarias, a través de una modificación de los parámetros (1) Hide_Captcha o (2) quesList en una acción validateAll.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2010-09-09 CVE Reserved
2011-02-10 First Exploit
2011-02-17 CVE Published
2024-08-07 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-20: Improper Input Validation

CAPEC

References (9)

URL	Tag	Source
http://securityreason.com/securityalert/8089	Third Party Advisory
http://www.osvdb.org/70870	Vdb Entry
http://www.securityfocus.com/archive/1/516396/100/0/threaded	Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/65350	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/35330	2011-02-10
http://www.coresecurity.com/content/zoho-manageengine-vulnerabilities	2024-08-07
http://www.securityfocus.com/bid/46331	2024-08-07

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/43241	2018-10-10
http://www.vupen.com/english/advisories/2011/0392	2018-10-10

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				<= 4.4 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version " <= 4.4"		-		Affected