ZDI-CAN-20033: ZDI-23-438: ManageEngine ADManager Plus ChangePasswordAction Command Injection Remote Code Execution Vulnerability
Published Apr 12, 2023
·Updated
This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine ADManager Plus. Authentication is required to exploit this vulnerability.
Affected Software
1 affected component
ManageEngine ADManager Plus
Event History
Apr 12, 2023
Advisory Published
05:00 AM
Data Sourced
05:00 AM
Description
Frequently Asked Questions
1
What is the severity of ZDI-CAN-20033?
The severity of ZDI-CAN-20033 is high as it allows remote code execution on affected installations of ManageEngine ADManager Plus.
2
How do I fix ZDI-CAN-20033?
To fix ZDI-CAN-20033, update ManageEngine ADManager Plus to the latest version provided by the vendor.
3
Who is affected by ZDI-CAN-20033?
Organizations using ManageEngine ADManager Plus are affected by ZDI-CAN-20033 if their systems are vulnerable.
4
What type of attacks can ZDI-CAN-20033 facilitate?
ZDI-CAN-20033 can facilitate remote code execution attacks, allowing attackers to run arbitrary code.
5
Is authentication required to exploit ZDI-CAN-20033?
Yes, authentication is required to exploit ZDI-CAN-20033.