CVE-2023-35719: medium-severity vulnerability in ManageEngine ADSelfService Plus
ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The ManageEngine ADSelfService Plus GINA Client doesn't properly verify data received over HTTP, allowing a physically present attacker to bypass login and run code with system privileges without authentication.
The vulnerability exists in the Password Reset Portal component where HTTP data lacks proper authentication verification (CWE-345). An unauthenticated, physically present attacker can bypass authentication controls and execute arbitrary code with SYSTEM privileges by exploiting insufficient data authenticity checks.
In the same product, most dangerous first.