CVE-2010-3272

CVE-2010-3272 describes a vulnerability in ZOHO ManageEngine ADSelfService Plus versions prior to 4.5 Build 4500. Attackers can exploit a flaw in the security-questions implementation, specifically within the accounts/ValidateAnswers component, by manipulating the Hide_Captcha or quesList parameters during a validateAll action. This allows remote attackers to bypass security measures, facilitating unauthorized password resets and gaining access to arbitrary user accounts. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity and potential for partial integrity impact (password resets). While not listed on the CISA KEV catalog or Hot List, an exploit module for ManageEngine ADSelfService Plus 4.4, leveraging POST manipulation for security questions, is available on ExploitDB. Despite the existence of public exploit code, there is no evidence of active exploitation, nor has it garnered significant community discussion or media coverage. Its EPSS score is low, suggesting a limited likelihood of exploitation in the wild.