CVE-2023-35854
First published: Tue Jun 20 2023(Updated: )
** DISPUTED ** Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability."
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zohocorp Manageengine Adselfservice Plus | <6.1 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6100 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6101 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6102 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6103 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6104 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6105 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6106 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6107 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6108 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6109 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6110 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6111 | |
| Zohocorp Manageengine Adselfservice Plus | =6.1-6112 | |
| <6.1 | ||
| =6.1 | ||
| =6.1-6100 | ||
| =6.1-6101 | ||
| =6.1-6102 | ||
| =6.1-6103 | ||
| =6.1-6104 | ||
| =6.1-6105 | ||
| =6.1-6106 | ||
| =6.1-6107 | ||
| =6.1-6108 | ||
| =6.1-6109 | ||
| =6.1-6110 | ||
| =6.1-6111 | ||
| =6.1-6112 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this Zoho ManageEngine ADSelfService Plus vulnerability?
The vulnerability ID for this Zoho ManageEngine ADSelfService Plus vulnerability is CVE-2023-35854.
What is the severity level of CVE-2023-35854?
The severity level of CVE-2023-35854 is critical.
How can the authentication bypass be exploited in Zoho ManageEngine ADSelfService Plus?
The authentication bypass in Zoho ManageEngine ADSelfService Plus can be exploited to steal the domain controller session token for identity spoofing and gain the privileges of the domain controller administrator.
What is the affected software version range for this vulnerability?
The affected software version range for this vulnerability is Zoho ManageEngine ADSelfService Plus 6.1 up to 6.1-6113.
Are there any references available for CVE-2023-35854?
Yes, there are references available for CVE-2023-35854. You can find them at the following links: [reference 1](https://github.com/970198175/Simply-use) and [reference 2](https://www.manageengine.com).
- collector/nvd-index
- agent/references
- agent/first-publish-date
- agent/author
- agent/type
- agent/severity
- agent/weakness
- agent/status
- agent/softwarecombine
- agent/description
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- status/disputed
- vendor/zohocorp
- canonical/zohocorp manageengine adselfservice plus
- version/zohocorp manageengine adselfservice plus/6.1
- version/zohocorp manageengine adselfservice plus/6.1-6100
- version/zohocorp manageengine adselfservice plus/6.1-6101
- version/zohocorp manageengine adselfservice plus/6.1-6102
- version/zohocorp manageengine adselfservice plus/6.1-6103
- version/zohocorp manageengine adselfservice plus/6.1-6104
- version/zohocorp manageengine adselfservice plus/6.1-6105
- version/zohocorp manageengine adselfservice plus/6.1-6106
- version/zohocorp manageengine adselfservice plus/6.1-6107
- version/zohocorp manageengine adselfservice plus/6.1-6108
- version/zohocorp manageengine adselfservice plus/6.1-6109
- version/zohocorp manageengine adselfservice plus/6.1-6110
- version/zohocorp manageengine adselfservice plus/6.1-6111
- version/zohocorp manageengine adselfservice plus/6.1-6112