In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Zohocorp | Manageengine Adaudit Plus | >= 0, < 8703CNA affecteddefault unaffected | |
| Zohocorp | Manageengine Adselfservice Plus | >= 0, < 6529CNA affecteddefault unaffected | |
| Zohocorp | Manageengine M365 Manager Plus | >= 0, < 4817CNA affecteddefault unaffected | |
| Zohocorp | Manageengine Recovery Manager Plus | >= 0, < 6321CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.4 Reddit, 1.2 Bluesky, 0.8 Mastodon, and 2.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.8 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.