CVE-2021-20148
03.01.2022, 22:15
ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticating to the service and then sending a request specifying the password policy file of the other domain.Enginsight
| Vendor | Product | Version |
|---|---|---|
| zohocorp | manageengine_adselfservice_plus | 𝑥 ≤ 6.0 |
| zohocorp | manageengine_adselfservice_plus | 6.1 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6100 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6101 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6102 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6103 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6104 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6105 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6106 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6107 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6108 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6109 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6110 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6111 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6112 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6113 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6114 |
| zohocorp | manageengine_adselfservice_plus | 6.1:6115 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration