SB2023062721 - Authentication bypass in ManageEngine ADSelfService Plus GINA Client
Published: June 27, 2023
Security Bulletin ID
SB2023062721
Severity
Low
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Physical access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Insufficient verification of data authenticity (CVE-ID: CVE-2023-35719)
The vulnerability allows an attacker to compromise the affected system.
The vulnerability exists due to the lack of proper authentication of data received via HTTP within the Password Reset Portal used by the GINA client. An attacker with physical access to the system can bypass authentication and compromise the system.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.