Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
ManageEngine ADSelfService Plus Authentication Bypass (CVE-2021-40539) - Vulnerability Database

ManageEngine ADSelfService Plus Authentication Bypass (CVE-2021-40539)

Description

ManageEngine ADSelfService Plus is a self-service password management and single sign-on solution for Active Directory and cloud applications.

ManageEngine ADSelfService Plus builds 6113 and below have an authentication bypass vulnerability in REST API. An unauthenticated attacker could exploit this vulnerability to take control of an affected system.

Remediation

Upgrade to the latest version of ManageEngine ADSelfService Plus

References

Security Advisory - CVE-2021-40539

Related Vulnerabilities

Microsoft ASP.NET Forms authentication bypass High
Common tags: Authentication Bypass
WordPress Plugin Thrive Headline Optimizer Security Bypass (1.3.7.2) High
Common tags: Authentication Bypass
WordPress Plugin Ultimate GDPR & CCPA Compliance Toolkit for WordPress Security Bypass (2.4) High
Common tags: Authentication Bypass
WordPress Plugin BuddyPress Multiple Security Bypass Vulnerabilities (7.2.0) High
Common tags: Authentication Bypass
WordPress Plugin Controlled Admin Access Security Bypass (1.4.0) High
Common tags: Authentication Bypass

Severity

High

Classification

CVE-2021-40539
CWE-287
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Authentication Bypass