← Back

CVE-2021-20147

nvd nist
Published: Jan 3, 2022Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.

Affected (18)

Zohocorp
1 product
Manageengine Adselfservice Plus
Configuration A
18 vulnerable
Vulnerable SoftwareAffected Versions
Zohocorp
Manageengine Adselfservice Plus
Up to 6.0
Manageengine Adselfservice Plus
Version 6.1
Manageengine Adselfservice Plus
Version 6.1 6100
Manageengine Adselfservice Plus
Version 6.1 6101
Manageengine Adselfservice Plus
Version 6.1 6102
Manageengine Adselfservice Plus
Version 6.1 6103
Manageengine Adselfservice Plus
Version 6.1 6104
Manageengine Adselfservice Plus
Version 6.1 6105
Manageengine Adselfservice Plus
Version 6.1 6106
Manageengine Adselfservice Plus
Version 6.1 6107
Manageengine Adselfservice Plus
Version 6.1 6108
Manageengine Adselfservice Plus
Version 6.1 6109
Manageengine Adselfservice Plus
Version 6.1 6110
Manageengine Adselfservice Plus
Version 6.1 6111
Manageengine Adselfservice Plus
Version 6.1 6112
Manageengine Adselfservice Plus
Version 6.1 6113
Manageengine Adselfservice Plus
Version 6.1 6114
Manageengine Adselfservice Plus
Version 6.1 6115

Related CWEs

CWE-203
Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (2)

Source: vulnreport@tenable.com
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory

Timeline

No history available yet.