CVE-2018-20664 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitre	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 84%

Vendor	Product	Version
zohocorp	manageengine_adselfservice_plus	5.7:4500
zohocorp	manageengine_adselfservice_plus	5.7:5032
zohocorp	manageengine_adselfservice_plus	5.7:5040
zohocorp	manageengine_adselfservice_plus	5.7:5041
zohocorp	manageengine_adselfservice_plus	5.7:5100
zohocorp	manageengine_adselfservice_plus	5.7:5101
zohocorp	manageengine_adselfservice_plus	5.7:5102
zohocorp	manageengine_adselfservice_plus	5.7:5103
zohocorp	manageengine_adselfservice_plus	5.7:5104
zohocorp	manageengine_adselfservice_plus	5.7:5105
zohocorp	manageengine_adselfservice_plus	5.7:5106
zohocorp	manageengine_adselfservice_plus	5.7:5107
zohocorp	manageengine_adselfservice_plus	5.7:5108
zohocorp	manageengine_adselfservice_plus	5.7:5109
zohocorp	manageengine_adselfservice_plus	5.7:5110
zohocorp	manageengine_adselfservice_plus	5.7:5111
zohocorp	manageengine_adselfservice_plus	5.7:5112
zohocorp	manageengine_adselfservice_plus	5.7:5113
zohocorp	manageengine_adselfservice_plus	5.7:5114
zohocorp	manageengine_adselfservice_plus	5.7:5115
zohocorp	manageengine_adselfservice_plus	5.7:5116
zohocorp	manageengine_adselfservice_plus	5.7:5200
zohocorp	manageengine_adselfservice_plus	5.7:5201
zohocorp	manageengine_adselfservice_plus	5.7:5202
zohocorp	manageengine_adselfservice_plus	5.7:5203
zohocorp	manageengine_adselfservice_plus	5.7:5204
zohocorp	manageengine_adselfservice_plus	5.7:5205
zohocorp	manageengine_adselfservice_plus	5.7:5206
zohocorp	manageengine_adselfservice_plus	5.7:5207
zohocorp	manageengine_adselfservice_plus	5.7:5300
zohocorp	manageengine_adselfservice_plus	5.7:5301
zohocorp	manageengine_adselfservice_plus	5.7:5302
zohocorp	manageengine_adselfservice_plus	5.7:5303
zohocorp	manageengine_adselfservice_plus	5.7:5304
zohocorp	manageengine_adselfservice_plus	5.7:5305
zohocorp	manageengine_adselfservice_plus	5.7:5306
zohocorp	manageengine_adselfservice_plus	5.7:5307
zohocorp	manageengine_adselfservice_plus	5.7:5308
zohocorp	manageengine_adselfservice_plus	5.7:5309
zohocorp	manageengine_adselfservice_plus	5.7:5310
zohocorp	manageengine_adselfservice_plus	5.7:5311
zohocorp	manageengine_adselfservice_plus	5.7:5312
zohocorp	manageengine_adselfservice_plus	5.7:5313
zohocorp	manageengine_adselfservice_plus	5.7:5314
zohocorp	manageengine_adselfservice_plus	5.7:5315
zohocorp	manageengine_adselfservice_plus	5.7:5316
zohocorp	manageengine_adselfservice_plus	5.7:5317
zohocorp	manageengine_adselfservice_plus	5.7:5318
zohocorp	manageengine_adselfservice_plus	5.7:5319
zohocorp	manageengine_adselfservice_plus	5.7:5320
zohocorp	manageengine_adselfservice_plus	5.7:5321
zohocorp	manageengine_adselfservice_plus	5.7:5322
zohocorp	manageengine_adselfservice_plus	5.7:5323
zohocorp	manageengine_adselfservice_plus	5.7:5324
zohocorp	manageengine_adselfservice_plus	5.7:5325
zohocorp	manageengine_adselfservice_plus	5.7:5326
zohocorp	manageengine_adselfservice_plus	5.7:5327
zohocorp	manageengine_adselfservice_plus	5.7:5328
zohocorp	manageengine_adselfservice_plus	5.7:5329
zohocorp	manageengine_adselfservice_plus	5.7:5330
zohocorp	manageengine_adselfservice_plus	5.7:5400
zohocorp	manageengine_adselfservice_plus	5.7:5500
zohocorp	manageengine_adselfservice_plus	5.7:5501
zohocorp	manageengine_adselfservice_plus	5.7:5502
zohocorp	manageengine_adselfservice_plus	5.7:5503
zohocorp	manageengine_adselfservice_plus	5.7:5504
zohocorp	manageengine_adselfservice_plus	5.7:5505
zohocorp	manageengine_adselfservice_plus	5.7:5506
zohocorp	manageengine_adselfservice_plus	5.7:5507
zohocorp	manageengine_adselfservice_plus	5.7:5508
zohocorp	manageengine_adselfservice_plus	5.7:5509
zohocorp	manageengine_adselfservice_plus	5.7:5510
zohocorp	manageengine_adselfservice_plus	5.7:5511
zohocorp	manageengine_adselfservice_plus	5.7:5512
zohocorp	manageengine_adselfservice_plus	5.7:5513
zohocorp	manageengine_adselfservice_plus	5.7:5514
zohocorp	manageengine_adselfservice_plus	5.7:5515
zohocorp	manageengine_adselfservice_plus	5.7:5516
zohocorp	manageengine_adselfservice_plus	5.7:5517
zohocorp	manageengine_adselfservice_plus	5.7:5518
zohocorp	manageengine_adselfservice_plus	5.7:5519
zohocorp	manageengine_adselfservice_plus	5.7:5520
zohocorp	manageengine_adselfservice_plus	5.7:5521
zohocorp	manageengine_adselfservice_plus	5.7:5600
zohocorp	manageengine_adselfservice_plus	5.7:5601
zohocorp	manageengine_adselfservice_plus	5.7:5602
zohocorp	manageengine_adselfservice_plus	5.7:5603
zohocorp	manageengine_adselfservice_plus	5.7:5604
zohocorp	manageengine_adselfservice_plus	5.7:5605
zohocorp	manageengine_adselfservice_plus	5.7:5606
zohocorp	manageengine_adselfservice_plus	5.7:5607
zohocorp	manageengine_adselfservice_plus	5.7:5700

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-611 - Improper Restriction of XML External Entity Reference
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References

https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20664/

https://www.manageengine.com/products/self-service-password/release-notes.html#5701

https://www.excellium-services.com/cert-xlm-advisory/cve-2018-20664/

https://www.manageengine.com/products/self-service-password/release-notes.html#5701