CVE-2024-0252

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-0252
ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.manageengine.com/products/self-service-password/advisory/CVE-2024-0252.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.4:6400:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.4:6401:*:*:*:*:*:*
History

19 Jan 2024, 18:54

Type Values Removed Values Added
CWE NVD-CWE-noinfo
References () https://www.manageengine.com/products/self-service-password/advisory/CVE-2024-0252.html - () https://www.manageengine.com/products/self-service-password/advisory/CVE-2024-0252.html - Vendor Advisory
First Time Zohocorp manageengine Adselfservice Plus
Zohocorp
CPE cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.4:6401:*:*:*:*:*:*
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.4:6400:*:*:*:*:*:*

15 Jan 2024, 15:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.9 		v2 : unknown
v3 : 8.8

15 Jan 2024, 14:15

Type Values Removed Values Added
Summary (en) ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. (en) ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.

11 Jan 2024, 13:57

Type Values Removed Values Added
Summary
  • (es) Las versiones 6401 e inferiores de ManageEngine ADSelfService Plus son vulnerables a la ejecución remota de código debido al manejo inadecuado en el componente del balanceador de carga.

11 Jan 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-11 08:15

Updated : 2024-01-19 18:54

NVD link : CVE-2024-0252

Mitre link : CVE-2024-0252

CVE.ORG link : CVE-2024-0252

JSON object : View

Products Affected

zohocorp

  • manageengine_adselfservice_plus
CWE
NVD-CWE-noinfo