CVEvulnerability
CVE-2019-7161
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-03-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-798
Description
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.
Affected configurations
• zohocorp manageengine adselfservice plus 5.0
• zohocorp manageengine adselfservice plus 5.1
• zohocorp manageengine adselfservice plus 5.2
• zohocorp manageengine adselfservice plus 5.3
• zohocorp manageengine adselfservice plus 5.4
• zohocorp manageengine adselfservice plus 5.5
• zohocorp manageengine adselfservice plus 5.6
• zohocorp manageengine adselfservice plus 5.7
Related
Weakness · CWE (1)
- CWE-798 Use of Hard-coded Credentials weakness
References
- https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-7161 cds.thalesgroup.com
- https://www.excellium-services.com/cert-xlm-advisory www.excellium-services.com
- https://www.excellium-services.com/cert-xlm-advisory/cve-2019-7161/ Third Party Advisory
- https://www.manageengine.com/products/self-service-password/release-notes.html Patch, Release Notes, Vendor Advisory
- https://www.excellium-services.com/cert-xlm-advisory/cve-2019-7161/ Third Party Advisory
- https://www.manageengine.com/products/self-service-password/release-notes.html Patch, Release Notes, Vendor Advisory