VulnerabilityModified

CVE-2024-0252

ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component.

HIGH 8.8EPSS 7.81%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (7.81%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 7.81% probability · 94th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: zohocorp/manageengine adselfservice plus
Source: 0fc0942c-577d-436f-ae8e-945763c79b02

References

https://www.manageengine.com/products/self-service-password/advisory/CVE-2024-0252.htmlVendor Advisory
https://www.manageengine.com/products/self-service-password/advisory/CVE-2024-0252.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.