← Back

CVE-2021-20148

nvd nist
Published: Jan 3, 2022Modified: Jun 17, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticating to the service and then sending a request specifying the password policy file of the other domain.

Affected (18)

Zohocorp
1 product
Manageengine Adselfservice Plus
Configuration A
18 vulnerable
Vulnerable SoftwareAffected Versions
Zohocorp
Manageengine Adselfservice Plus
Up to 6.0
Manageengine Adselfservice Plus
Version 6.1
Manageengine Adselfservice Plus
Version 6.1 6100
Manageengine Adselfservice Plus
Version 6.1 6101
Manageengine Adselfservice Plus
Version 6.1 6102
Manageengine Adselfservice Plus
Version 6.1 6103
Manageengine Adselfservice Plus
Version 6.1 6104
Manageengine Adselfservice Plus
Version 6.1 6105
Manageengine Adselfservice Plus
Version 6.1 6106
Manageengine Adselfservice Plus
Version 6.1 6107
Manageengine Adselfservice Plus
Version 6.1 6108
Manageengine Adselfservice Plus
Version 6.1 6109
Manageengine Adselfservice Plus
Version 6.1 6110
Manageengine Adselfservice Plus
Version 6.1 6111
Manageengine Adselfservice Plus
Version 6.1 6112
Manageengine Adselfservice Plus
Version 6.1 6113
Manageengine Adselfservice Plus
Version 6.1 6114
Manageengine Adselfservice Plus
Version 6.1 6115

Related CWEs

CWE-552
Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (2)

Source: vulnreport@tenable.com
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory

Timeline

No history available yet.