Read the docs
TI-2018-03888 Aliases CVE-2018-5353GHSA-p8cf-jjc3-phj5

The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517…

Priority MEDIUM 55CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-290.

Summary

The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required

Why it matters now

EPSS 0.11149 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*before 5.5VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:-:*:*:*:*:*:*5.5VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5500:*:*:*:*:*:*5.5 5500VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5501:*:*:*:*:*:*5.5 5501VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5502:*:*:*:*:*:*5.5 5502VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5503:*:*:*:*:*:*5.5 5503VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5504:*:*:*:*:*:*5.5 5504VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5505:*:*:*:*:*:*5.5 5505VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5506:*:*:*:*:*:*5.5 5506VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5507:*:*:*:*:*:*5.5 5507VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* Versions before 5.5 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:-:*:*:*:*:*:* Versions 5.5 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5500:*:*:*:*:*:* Versions 5.5 5500 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5501:*:*:*:*:*:* Versions 5.5 5501 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5502:*:*:*:*:*:* Versions 5.5 5502 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5503:*:*:*:*:*:* Versions 5.5 5503 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5504:*:*:*:*:*:* Versions 5.5 5504 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5505:*:*:*:*:*:* Versions 5.5 5505 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5506:*:*:*:*:*:* Versions 5.5 5506 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5507:*:*:*:*:*:* Versions 5.5 5507 Vulnerable ·Zohocorp
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5508:*:*:*:*:*:*5.5 5508VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5509:*:*:*:*:*:*5.5 5509VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5510:*:*:*:*:*:*5.5 5510VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5511:*:*:*:*:*:*5.5 5511VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5512:*:*:*:*:*:*5.5 5512VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5513:*:*:*:*:*:*5.5 5513VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5514:*:*:*:*:*:*5.5 5514VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5515:*:*:*:*:*:*5.5 5515VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5516:*:*:*:*:*:*5.5 5516VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5508:*:*:*:*:*:* Versions 5.5 5508 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5509:*:*:*:*:*:* Versions 5.5 5509 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5510:*:*:*:*:*:* Versions 5.5 5510 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5511:*:*:*:*:*:* Versions 5.5 5511 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5512:*:*:*:*:*:* Versions 5.5 5512 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5513:*:*:*:*:*:* Versions 5.5 5513 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5514:*:*:*:*:*:* Versions 5.5 5514 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5515:*:*:*:*:*:* Versions 5.5 5515 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5516:*:*:*:*:*:* Versions 5.5 5516 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-5353
  2. 2026-10-03 Alias added: GHSA-p8cf-jjc3-phj5

References

Exploit 1

Advisory 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-17574 Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-11432 Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated… KEVCVSS 3.1MEDIUM 6.8
  • TI-2021-09883 Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote… CVSS 3.1CRITICAL 9.8
  • TI-2023-12890 Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a… CVSS 3.1HIGH 7.5
  • TI-2021-12772 A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus… CVSS 3.1HIGH 8.8
See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences