Zoho ManageEngine ADSelfService Plus before 6122 allows... · CVE-2022-28810 · GitHub Advisory Database · GitHub

Zoho ManageEngine ADSelfService Plus before 6122 allows...

High severity Unreviewed Published Apr 19, 2022 to the GitHub Advisory Database • Updated Jan 29, 2025

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

Zoho ManageEngine ADSelfService Plus before 6122 allows an authenticated user to achieve remote code execution via executable CMD.EXE input in a password field, This only occurs if a certain password sync feature is enabled that uses passwords as script arguments.

References

Published by the National Vulnerability Database

Apr 18, 2022

Published to the GitHub Advisory Database Apr 19, 2022

Last updated Jan 29, 2025

Weaknesses

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Learn more on MITRE.

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Learn more on MITRE.