CVE-2010-3272
EUVD-2010-327117.02.2011, 18:00
accounts/ValidateAnswers in the security-questions implementation in ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 makes it easier for remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, via a modified (1) Hide_Captcha or (2) quesList parameter in a validateAll action.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| zohocorp | manageengine_adselfservice_plus | 𝑥 ≤ 4.4 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References