Lucene search

[email protected]CVE-2019-7161

HistoryMar 21, 2019 - 4:01 p.m.

CVE-2019-7161

2019-03-2116:01:00

CWE-798

[email protected]

web.nvd.nist.gov

zoho

manageengine

adselfservice

vulnerability

cve-2019-7161

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.013 Low

EPSS

Percentile

85.9%

JSON

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.

CPENameOperatorVersion
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.7
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.0
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.1
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.2
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.3
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.4
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.5
zohocorp:manageengine_adselfservice_pluszohocorp manageengine adselfservice pluseq5.6

CPE	Name	Operator	Version
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.7
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.0
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.1
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.2
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.3
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.4
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.5
zohocorp:manageengine_adselfservice_plus	zohocorp manageengine adselfservice plus	eq	5.6

References

www.excellium-services.com/cert-xlm-advisory/cve-2019-7161/

www.manageengine.com/products/self-service-password/release-notes.html

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.3 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.013 Low

EPSS

Percentile

85.9%

JSON

Related for CVE-2019-7161

prion1 cvelist1