ID:7798 - Exploit for Information disclosure in Zoho ManageEngine ADSelfService Plus - CVE-2022-29457

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to NTLM Hash being disclosed by operators when configuring the storage path of a remote machine in the Reports tab has now been fixed. A remote attacker can gain restore victim's credentials and gain unauthorized access to the system.

Remediation