CVE-2025-1723

Published: Mar 3, 2025Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: 0fc0942c-577d-436f-ae8e-945763c79b02 (Secondary)

Description

Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug.

Affected (12)

Products: Zohocorp: Manageengine Adselfservice Plus

Zohocorp

1 product

Manageengine Adselfservice Plus

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Adselfservice Plus	Before 6.5
Zohocorp Manageengine Adselfservice Plus	Version 6.5 6500
Zohocorp Manageengine Adselfservice Plus	Version 6.5 6501
Zohocorp Manageengine Adselfservice Plus	Version 6.5 6502
Zohocorp Manageengine Adselfservice Plus	Version 6.5 6503
Zohocorp Manageengine Adselfservice Plus	Version 6.5 6504
Zohocorp Manageengine Adselfservice Plus	Version 6.5 6505
Zohocorp Manageengine Adselfservice Plus	Version 6.5 6506
Zohocorp Manageengine Adselfservice Plus	Version 6.5 6507
Zohocorp Manageengine Adselfservice Plus	Version 6.5 6508
Zohocorp Manageengine Adselfservice Plus	Version 6.5 6509
Zohocorp Manageengine Adselfservice Plus	Version 6.5 6510

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (1)

https://www.manageengine.com/products/self-service-password/advisory/CVE-2025-1723.html

Source: 0fc0942c-577d-436f-ae8e-945763c79b02

Vendor Advisory

Timeline

No history available yet.