CVE-2019-18411

high-risk
Published 2019-11-06

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own.

Do I need to act?

-
0.17% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Zohocorp

References (2)

Third Party Advisory https://gist.github.com/aliceicl/e32fb4a17277c7db9e0256185ac03dae
Third Party Advisory https://gist.github.com/aliceicl/e32fb4a17277c7db9e0256185ac03dae
62
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 1/34 · Minimal
Exposure 31/34 · Critical