CVE-2010-3273: Input Validation
Published Feb 17, 2011
·Updated
ZOHO ManageEngine ADSelfService Plus before 4.5 Build 4500 allows remote attackers to reset user passwords, and consequently obtain access to arbitrary user accounts, by providing a user id to accounts/ValidateUser, and then providing a new password to accounts/ResetResult.
Affected Software
1 affected component
ZohoCorp ManageEngine ADSelfService Plus<=4.4
Event History
Feb 17, 2011
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2010-3273?
CVE-2010-3273 has a high severity rating due to its ability to allow unauthorized password resets.
2
How do I fix CVE-2010-3273?
To mitigate CVE-2010-3273, upgrade to ManageEngine ADSelfService Plus version 4.5 Build 4500 or later.
3
What type of attack does CVE-2010-3273 enable?
CVE-2010-3273 enables remote attackers to perform unauthorized password resets on user accounts.
4
Which versions of ManageEngine ADSelfService Plus are affected by CVE-2010-3273?
CVE-2010-3273 affects ManageEngine ADSelfService Plus versions prior to 4.5 Build 4500.
5
What can be compromised due to CVE-2010-3273?
CVE-2010-3273 can lead to unauthorized access to arbitrary user accounts.