CVE-2019-12476 - An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser

Back Back to CVE browser

MEDIUM

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser

Published Jun 17, 2019

6.8

MEDIUM

CVSS 3.0

EPSS 1.53%

Description

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboard input.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-640

References (4)

http://www.securityfocus.com/bid/108813
vdb-entryx_refsource_BID
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4072
Advisory
https://gist.github.com/0katz/54167ba30ea361f3776e269bb7b1afb3
x_refsource_MISCBroken Link
https://github.com/0katz/CVE-2019-12476
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/108813		vdb-entryx_refsource_BID
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4072		Advisory
https://gist.github.com/0katz/54167ba30ea361f3776e269bb7b1afb3		x_refsource_MISCBroken Link
https://github.com/0katz/CVE-2019-12476		x_refsource_MISCExploitThird Party Advisory