Information disclosure in Zoho ManageEngine ADSelfService Plus - #VU63623
Published: May 25, 2022
Vulnerability identifier: #VU63623
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the username information in the request URL is sent to the ADSelfService Plus server upon successful IdP authentication. A remote attacker can obtain this information in certain cases.
Affected software
Zoho ManageEngine ADSelfService Plus
Remediation
Install updates from vendor's website.
Zoho ManageEngine ADSelfService Plus - update to 6200