Severity
Medium
Analysis Summary
CVE-2023-35854
Zoho ManageEngine ADSelfService Plus could allow a remote attacker to bypass security restrictions, caused by pmproper protection to the domain controller session token. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass authentication and achieving the privileges of the domain controller administrator.
Impact
- Security Bypass
Indicators Of Compromise
CVE
- CVE-2023-35854
Affected Vendors
Zoho
Affected Products
- Zoho ManageEngine ADSelfService Plus 6113
Remediation
Refer to ManageEngine Web site for the patch, upgrade, or suggested workaround information.