CVE-2021-28958
CRITICALManageEngine ADSelfService Plus <= 6101 - Unauthenticated Remote Code Execution
Title source: llmDescription
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
References (4)
Core 4
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://www.manageengine.com/products/self-service-password/release-notes.html#6102
Third Party Advisory x_refsource_misc
https://blog.stmcyber.com/vulns/cve-2021-28958/
Vendor Advisory x_refsource_confirm
https://pitstop.manageengine.com/portal/en/community/topic/adselfservice-plus-6102-released-with-an-important-security-fix-21-3-2021
Vendor Advisory x_refsource_misc
https://www.manageengine.com
Scores
CVSS v3
9.8
EPSS
0.4894
EPSS Percentile
97.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (5)
zohocorp/manageengine_adselfservice_plus
4.5 4510 (17 CPE variants)
zohocorp/manageengine_adselfservice_plus
5.0 5000 (12 CPE variants)
zohocorp/manageengine_adselfservice_plus
5.0.6
zohocorp/manageengine_adselfservice_plus
5.1 5100 (17 CPE variants)
zohocorp/manageengine_adselfservice_plus
5.2 5200 (3 CPE variants)
Published
Jun 25, 2021
Tracked Since
Feb 18, 2026