CVE-2022-36413

Summary

CVE	CVE-2022-36413
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-03-23 20:15:00 UTC
Updated	2023-03-30 15:38:00 UTC
Description	Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications.

Risk And Classification

Problem Types: CWE-307

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Zohocorp	Manageengine Adselfservice Plus	All	All	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6200	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6201	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6202	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6203	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6204	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6205	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6206	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6207	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6208	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6209	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6210	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6211	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6212	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6213	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6214	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6215	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6216	All	All
Application	Zohocorp	Manageengine Adselfservice Plus	6.2	6217	All	All

References

Reference	Source	Link	Tags
CVE-2022-36413 – ManageEngine ADSelfService Plus	MISC	www.manageengine.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

378408 Zoho ManageEngine ADSelfService Plus OTP Brute-Force Weakness Vulnerability