CVE-2019-7161: High severity adselfservice plus vulnerability

Published Mar 18, 2019

Updated

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.

Affected Software

138 affected components

ZohoCorp ManageEngine ADSelfService Plus=5.0-5000

ZohoCorp ManageEngine ADSelfService Plus=5.0-5001

ZohoCorp ManageEngine ADSelfService Plus=5.0-5002

ZohoCorp ManageEngine ADSelfService Plus=5.0-5010

ZohoCorp ManageEngine ADSelfService Plus=5.0-5011

ZohoCorp ManageEngine ADSelfService Plus=5.0-5020

ZohoCorp ManageEngine ADSelfService Plus=5.0-5021

ZohoCorp ManageEngine ADSelfService Plus=5.0-5022

ZohoCorp ManageEngine ADSelfService Plus=5.0-5030

ZohoCorp ManageEngine ADSelfService Plus=5.0-5032

ZohoCorp ManageEngine ADSelfService Plus=5.0-5040

ZohoCorp ManageEngine ADSelfService Plus=5.0-5041

ZohoCorp ManageEngine ADSelfService Plus=5.1-5100

ZohoCorp ManageEngine ADSelfService Plus=5.1-5101

ZohoCorp ManageEngine ADSelfService Plus=5.1-5102

ZohoCorp ManageEngine ADSelfService Plus=5.1-5103

ZohoCorp ManageEngine ADSelfService Plus=5.1-5104

ZohoCorp ManageEngine ADSelfService Plus=5.1-5105

ZohoCorp ManageEngine ADSelfService Plus=5.1-5106

ZohoCorp ManageEngine ADSelfService Plus=5.1-5107

ZohoCorp ManageEngine ADSelfService Plus=5.1-5108

ZohoCorp ManageEngine ADSelfService Plus=5.1-5109

ZohoCorp ManageEngine ADSelfService Plus=5.1-5110

ZohoCorp ManageEngine ADSelfService Plus=5.1-5111

ZohoCorp ManageEngine ADSelfService Plus=5.1-5112

ZohoCorp ManageEngine ADSelfService Plus=5.1-5113

ZohoCorp ManageEngine ADSelfService Plus=5.1-5114

ZohoCorp ManageEngine ADSelfService Plus=5.1-5115

ZohoCorp ManageEngine ADSelfService Plus=5.2-5200

ZohoCorp ManageEngine ADSelfService Plus=5.2-5201

ADSelfService Plus=5.2-5202

ADSelfService Plus=5.2-5203

ADSelfService Plus=5.2-5204

ADSelfService Plus=5.2-5205

ADSelfService Plus=5.2-5206

Zohocorp ManageEngine ADSelfService Plus=5.2-5207

Zohocorp ManageEngine ADSelfService Plus=5.3-5300

Zohocorp ManageEngine ADSelfService Plus=5.3-5301

Zohocorp ManageEngine ADSelfService Plus=5.3-5302

Zohocorp ManageEngine ADSelfService Plus=5.3-5303

Zohocorp ManageEngine ADSelfService Plus=5.3-5304

Zohocorp ManageEngine ADSelfService Plus=5.3-5305

Zohocorp ManageEngine ADSelfService Plus=5.3-5306

Zohocorp ManageEngine ADSelfService Plus=5.3-5307

Zohocorp ManageEngine ADSelfService Plus=5.3-5308

Zohocorp ManageEngine ADSelfService Plus=5.3-5309

Zohocorp ManageEngine ADSelfService Plus=5.3-5310

Zohocorp ManageEngine ADSelfService Plus=5.3-5311

Zohocorp ManageEngine ADSelfService Plus=5.3-5312

Zohocorp ManageEngine ADSelfService Plus=5.3-5313

Zohocorp ManageEngine ADSelfService Plus=5.3-5314

Zohocorp ManageEngine ADSelfService Plus=5.3-5315

Zohocorp ManageEngine ADSelfService Plus=5.3-5316

Zohocorp ManageEngine ADSelfService Plus=5.3-5317

Zohocorp ManageEngine ADSelfService Plus=5.3-5318

Zohocorp ManageEngine ADSelfService Plus=5.3-5319

Zohocorp ManageEngine ADSelfService Plus=5.3-5320

Zohocorp ManageEngine ADSelfService Plus=5.3-5321

Zohocorp ManageEngine ADSelfService Plus=5.3-5322

Zohocorp ManageEngine ADSelfService Plus=5.3-5323

Zohocorp ManageEngine ADSelfService Plus=5.3-5324

Zohocorp ManageEngine ADSelfService Plus=5.3-5325

Zohocorp ManageEngine ADSelfService Plus=5.3-5326

Zohocorp ManageEngine ADSelfService Plus=5.3-5327

Zohocorp ManageEngine ADSelfService Plus=5.3-5328

Zohocorp ManageEngine ADSelfService Plus=5.3-5329

Zohocorp ManageEngine ADSelfService Plus=5.3-5330

Zohocorp ManageEngine ADSelfService Plus=5.4-5400

Zohocorp ManageEngine ADSelfService Plus=5.5-5500

Zohocorp ManageEngine ADSelfService Plus=5.5-5501

Zohocorp ManageEngine ADSelfService Plus=5.5-5502

Zohocorp ManageEngine ADSelfService Plus=5.5-5503

Zohocorp ManageEngine ADSelfService Plus=5.5-5504

Zohocorp ManageEngine ADSelfService Plus=5.5-5505

Zohocorp ManageEngine ADSelfService Plus=5.5-5506

Zohocorp ManageEngine ADSelfService Plus=5.5-5507

Zohocorp ManageEngine ADSelfService Plus=5.5-5508

Zohocorp ManageEngine ADSelfService Plus=5.5-5509

Zohocorp ManageEngine ADSelfService Plus=5.5-5510

Zohocorp ManageEngine ADSelfService Plus=5.5-5511

Zohocorp ManageEngine ADSelfService Plus=5.5-5512

Zohocorp ManageEngine ADSelfService Plus=5.5-5513

Zohocorp ManageEngine ADSelfService Plus=5.5-5514

Zohocorp ManageEngine ADSelfService Plus=5.5-5515

Zohocorp ManageEngine ADSelfService Plus=5.5-5516

Zohocorp ManageEngine ADSelfService Plus=5.5-5517

Zohocorp ManageEngine ADSelfService Plus=5.5-5518

Zohocorp ManageEngine ADSelfService Plus=5.5-5519

Zohocorp ManageEngine ADSelfService Plus=5.5-5520

Zohocorp ManageEngine ADSelfService Plus=5.5-5521

Zohocorp ManageEngine ADSelfService Plus=5.6-5600

Zohocorp ManageEngine ADSelfService Plus=5.6-5601

Zohocorp ManageEngine ADSelfService Plus=5.6-5602

Zohocorp ManageEngine ADSelfService Plus=5.6-5603

Zohocorp ManageEngine ADSelfService Plus=5.6-5604

Zohocorp ManageEngine ADSelfService Plus=5.6-5605

Zohocorp ManageEngine ADSelfService Plus=5.6-5606

Zohocorp ManageEngine ADSelfService Plus=5.6-5607

Zohocorp ManageEngine ADSelfService Plus=5.7-5700

Zohocorp ManageEngine ADSelfService Plus=5.7-5701

Zohocorp ManageEngine ADSelfService Plus=5.7-5702

Zohocorp ManageEngine ADSelfService Plus=5.7-5703

Zohocorp ManageEngine ADSelfService Plus=5.7-5704

Zohocorp ManageEngine ADSelfService Plus=5.0-5000

Zohocorp ManageEngine ADSelfService Plus=5.0-5001

Zohocorp ManageEngine ADSelfService Plus=5.0-5002

Zohocorp ManageEngine ADSelfService Plus=5.0-5010

Zohocorp ManageEngine ADSelfService Plus=5.0-5011

Zohocorp ManageEngine ADSelfService Plus=5.0-5020

Zohocorp ManageEngine ADSelfService Plus=5.0-5021

Zohocorp ManageEngine ADSelfService Plus=5.0-5022

Zohocorp ManageEngine ADSelfService Plus=5.0-5030

Zohocorp ManageEngine ADSelfService Plus=5.0-5032

Zohocorp ManageEngine ADSelfService Plus=5.0-5040

Zohocorp ManageEngine ADSelfService Plus=5.0-5041

Zohocorp ManageEngine ADSelfService Plus=5.1-5100

Zohocorp ManageEngine ADSelfService Plus=5.1-5101

Zohocorp ManageEngine ADSelfService Plus=5.1-5102

Zohocorp ManageEngine ADSelfService Plus=5.1-5103

Zohocorp ManageEngine ADSelfService Plus=5.1-5104

Zohocorp ManageEngine ADSelfService Plus=5.1-5105

Zohocorp ManageEngine ADSelfService Plus=5.1-5106

Zohocorp ManageEngine ADSelfService Plus=5.1-5107

Zohocorp ManageEngine ADSelfService Plus=5.1-5108

Zohocorp ManageEngine ADSelfService Plus=5.1-5109

Zohocorp ManageEngine ADSelfService Plus=5.1-5110

Zohocorp ManageEngine ADSelfService Plus=5.1-5111

Zohocorp ManageEngine ADSelfService Plus=5.1-5112

Zohocorp ManageEngine ADSelfService Plus=5.1-5113

Zohocorp ManageEngine ADSelfService Plus=5.1-5114

Zohocorp ManageEngine ADSelfService Plus=5.1-5115

Zohocorp ManageEngine ADSelfService Plus=5.2-5200

Zohocorp ManageEngine ADSelfService Plus=5.2-5201

Zohocorp ManageEngine ADSelfService Plus=5.2-5202

Zohocorp ManageEngine ADSelfService Plus=5.2-5203

Zohocorp ManageEngine ADSelfService Plus=5.2-5204

Zohocorp ManageEngine ADSelfService Plus=5.2-5205

Zohocorp ManageEngine ADSelfService Plus=5.2-5206

Remediation

Patch Available

https://www.manageengine.com/products/self-service-password/release-notes.html

Event History

Mar 18, 2019

CVE Published

via MITRE·08:39 PM

Data Sourced

via MITRE·08:39 PM

Description

Mar 21, 2019

Data Sourced

via NVD·04:01 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-7161?

CVE-2019-7161 has been assigned a high severity rating due to the use of fixed ciphering keys, allowing potential data decryption by attackers.

How do I fix CVE-2019-7161?

To fix CVE-2019-7161, update to the latest version of Zoho ManageEngine ADSelfService Plus where the issue has been addressed.

What impact does CVE-2019-7161 have on confidential data?

CVE-2019-7161 could lead to unauthorized access to sensitive information, compromising its confidentiality.

Which versions of Zoho ManageEngine ADSelfService Plus are affected by CVE-2019-7161?

CVE-2019-7161 affects various 5.x versions of Zoho ManageEngine ADSelfService Plus, specifically up to build 5704.

Is authentication required to exploit CVE-2019-7161?

Authentication is not required to exploit CVE-2019-7161, making it particularly dangerous for securing sensitive data.