SB2019110707 - Cross-site request forgery in Zoho ManageEngine ADSelfService Plus

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019110707

SB2019110707 - Cross-site request forgery in Zoho ManageEngine ADSelfService Plus

Published: November 7, 2019

Security Bulletin ID SB2019110707
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Cross-site request forgery (CVE-ID: CVE-2019-18411)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin on the user's profile information page. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website, such as modify user's enrolled information, e.g. email and mobile phone.

Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own.


Remediation

Install update from vendor's website.

References