CVE-2010-3272

ManageEngine ADSelfService Plus 4.4 - POST Manipulation Security Question

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified (1) Hide_Captcha or (2) quesList parameter in a validateAll action.

accounts/ValidateAnswers en la implementación de seguridad-preguntas en Zoho ManageEngine ADSelfService Plus anterior a v4.5 Build 4500 facilita a los atacantes remotos restablecer las contraseñas de usuario, y en consecuencia obtener acceso a cuentas de usuario arbitrarias, a través de una modificación de los parámetros (1) Hide_Captcha o (2) quesList en una acción validateAll.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2010-09-09 CVE Reserved
2011-02-10 CVE Published
2011-02-10 First Exploit
2024-06-02 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-20: Improper Input Validation

CAPEC

References (9)

URL	Tag	Source
http://securityreason.com/securityalert/8089	Third Party Advisory
http://www.osvdb.org/70870	Vdb Entry
http://www.securityfocus.com/archive/1/516396/100/0/threaded	Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/65350	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/35330	2011-02-10
http://www.coresecurity.com/content/zoho-manageengine-vulnerabilities	2024-08-07
http://www.securityfocus.com/bid/46331	2024-08-07

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/43241	2018-10-10
http://www.vupen.com/english/advisories/2011/0392	2018-10-10

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Zohocorp Search vendor "Zohocorp"		Manageengine Adselfservice Plus Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"				<= 4.4 Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version " <= 4.4"		-		Affected