ZDI-23-438: ManageEngine ADManager Plus ChangePasswordAction Command Injection Remote Code Execution Vulnerability
Published Apr 12, 2023
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine ADManager Plus. Authentication is required to exploit this vulnerability.
Affected Software
1 affected component
ManageEngine ADManager Plus
Event History
Apr 12, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-23-438?
The severity of ZDI-23-438 is high due to the potential for remote code execution.
2
How do I fix ZDI-23-438?
To fix ZDI-23-438, apply the latest security patch provided by ManageEngine for ADManager Plus.
3
What kind of attacks can exploit ZDI-23-438?
ZDI-23-438 can be exploited by authenticated remote attackers to execute arbitrary code on affected systems.
4
Is authentication required to exploit ZDI-23-438?
Yes, authentication is required to exploit ZDI-23-438.
5
What versions of ManageEngine ADManager Plus are affected by ZDI-23-438?
ZDI-23-438 affects all installations of ManageEngine ADManager Plus that are unpatched.