Not rated

CVE-2021-20147 ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of…

Description

ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.

Affected products and versions

Product	Affected versions	Fixed in
ManageEngine ADSelfService Plus 6116	earliest → < 6116	6116

The 2 CVEs of ManageEngine ADSelfService Plus →

CVE-2021-20148 ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web… Not rated

Do you use ManageEngine ADSelfService Plus?

Track this CVE Watch ManageEngine ADSelfService Plus Check my SBOMs

www.cveye.io/en/cve/CVE-2021-20147

Timeline

Published January 3, 2022
Last modified August 3, 2024

References

www.tenable.com www.tenable.com

Track this CVE

CVE-2021-20147 ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of…

Description

Affected products and versions

Other CVEs of ManageEngine ADSelfService Plus