CVE-2021-20148

2022-01-0321:07:11

tenable

www.cve.org

cve-2021-20148

manageengine adselfservice plus

password policy

predictable filename

multiple windows domains

authentication vulnerability

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

44.5%

JSON

ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticating to the service and then sending a request specifying the password policy file of the other domain.

CNA Affected

[
  {
    "product": "ManageEngine ADSelfService Plus",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "< 6116"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2021-52