Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| 2023-03-07 | 2023-03-28 | Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability | Apply updates per vendor instructions. |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 3.1 | 6.8 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
| Secondary | 3.1 | 6.8 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
| Primary | 2.0 | 7.1 | HIGH | AV:N/AC:H/Au:S/C:C/I:C/A:C |