// For flags

CVE-2021-20147

 

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.

ManageEngine ADSelfService Plus versiones anteriores a la compilaciĆ³n 6116, contiene una discrepancia de respuesta observable en la operaciĆ³n UMCP de la ChangePasswordAPI. Esto permite a un atacante remoto no autenticado determinar si se presenta un usuario de dominio de Windows

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-12-17 CVE Reserved
  • 2022-01-03 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • 2024-09-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-203: Observable Discrepancy
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
<= 6.0
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version " <= 6.0"
-
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
-
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6100
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6101
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6102
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6103
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6104
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6105
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6106
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6107
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6108
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6109
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6110
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6111
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6112
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6113
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6114
Affected
Zohocorp
Search vendor "Zohocorp"
Manageengine Adselfservice Plus
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus"
6.1
Search vendor "Zohocorp" for product "Manageengine Adselfservice Plus" and version "6.1"
6115
Affected