CVE-2025-1723: Account takeover
Published Mar 3, 2025
·Updated
Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug.
Affected Software
13 affected components
ZohoCorp ManageEngine ADSelfService Plus<=6510
ZohoCorp ManageEngine ADSelfService Plus<6.5
ZohoCorp ManageEngine ADSelfService Plus=6.5-6500
ZohoCorp ManageEngine ADSelfService Plus=6.5-6501
ZohoCorp ManageEngine ADSelfService Plus=6.5-6502
ZohoCorp ManageEngine ADSelfService Plus=6.5-6503
ZohoCorp ManageEngine ADSelfService Plus=6.5-6504
ZohoCorp ManageEngine ADSelfService Plus=6.5-6505
ZohoCorp ManageEngine ADSelfService Plus=6.5-6506
ZohoCorp ManageEngine ADSelfService Plus=6.5-6507
ZohoCorp ManageEngine ADSelfService Plus=6.5-6508
ZohoCorp ManageEngine ADSelfService Plus=6.5-6509
ZohoCorp ManageEngine ADSelfService Plus=6.5-6510
Event History
Mar 3, 2025
CVE Published
via MITRE·07:40 AM
Data Sourced
via MITRE·07:40 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-1723?
CVE-2025-1723 has a high severity rating due to the potential for account takeover resulting from session mishandling.
2
How do I fix CVE-2025-1723?
To mitigate CVE-2025-1723, update Zohocorp ManageEngine ADSelfService Plus to version 6511 or later.
3
Who is affected by CVE-2025-1723?
CVE-2025-1723 affects all users of Zohocorp ManageEngine ADSelfService Plus versions 6510 and below.
4
What type of vulnerability is CVE-2025-1723?
CVE-2025-1723 is a session handling vulnerability that can lead to account takeover.
5
Can valid account holders exploit CVE-2025-1723?
Yes, valid account holders can potentially exploit CVE-2025-1723 due to the mishandling of sessions.