CVE-2018-5353

Katalog CVE

CVSS 9.8 · Critical EPSS 11,1%

Kerentanan Authentication Bypass by Spoofing pada zohocorp manageengine adselfservice plus. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required

Rincian

Terbit di NVD

30 September 2020

Terakhir diubah

9 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

11,1% peluang dieksploitasi; lebih tinggi dari 95,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.manageengine.com/products/self-service-password/release-notes.html release notes · advisory vendor
• https://github.com/missing0x00/CVE-2018-5353 exploit · advisory pihak ketiga