CVE-2021-20147: Medium severity adselfservice plus vulnerability

Published Jan 3, 2022
·
Updated

ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.

Affected Software

18 affected components
ZohoCorp ManageEngine ADSelfService Plus<=6.0
ZohoCorp ManageEngine ADSelfService Plus=6.1
ZohoCorp ManageEngine ADSelfService Plus=6.1-6100
ZohoCorp ManageEngine ADSelfService Plus=6.1-6101
ZohoCorp ManageEngine ADSelfService Plus=6.1-6102
ZohoCorp ManageEngine ADSelfService Plus=6.1-6103
ZohoCorp ManageEngine ADSelfService Plus=6.1-6104
ZohoCorp ManageEngine ADSelfService Plus=6.1-6105
ZohoCorp ManageEngine ADSelfService Plus=6.1-6106
ZohoCorp ManageEngine ADSelfService Plus=6.1-6107
ZohoCorp ManageEngine ADSelfService Plus=6.1-6108
ZohoCorp ManageEngine ADSelfService Plus=6.1-6109
ZohoCorp ManageEngine ADSelfService Plus=6.1-6110
ZohoCorp ManageEngine ADSelfService Plus=6.1-6111
ZohoCorp ManageEngine ADSelfService Plus=6.1-6112
ZohoCorp ManageEngine ADSelfService Plus=6.1-6113
ZohoCorp ManageEngine ADSelfService Plus=6.1-6114
ZohoCorp ManageEngine ADSelfService Plus=6.1-6115

Event History

Jan 3, 2022
CVE Published
via MITRE·09:07 PM
Data Sourced
via MITRE·09:07 PM
DescriptionWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2021-20147?

CVE-2021-20147 is a vulnerability in ManageEngine ADSelfService Plus below build 6116 that allows an unauthenticated remote attacker to determine whether a Windows domain user exists.

2

What is the severity of CVE-2021-20147?

The severity of CVE-2021-20147 is medium, with a severity value of 5.3.

3

How does CVE-2021-20147 affect ManageEngine ADSelfService Plus?

CVE-2021-20147 affects ManageEngine ADSelfService Plus below build 6116.

4

How can an attacker exploit CVE-2021-20147?

An attacker can exploit CVE-2021-20147 by sending requests to the UMCP operation of the ChangePasswordAPI and observing the response discrepancy to determine the existence of a Windows domain user.

5

Where can I find more information about CVE-2021-20147?

You can find more information about CVE-2021-20147 at the following link: [CVE-2021-20147](https://www.tenable.com/security/research/tra-2021-52)

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203