Read the docs
TI-2021-03447 Aliases CVE-2021-20147GHSA-j385-q64g-xhxj

Observable discrepancy in ManageEngine ADSelfService Plus

Priority LOW 34CWE-203Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-203.

Summary

ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.

Why it matters now

EPSS 0.07124 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ManageEngine ADSelfService Plus: 6116

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—ManageEngine ADSelfService Plusbefore 61166116Patch availableCNA
  • ManageEngine ADSelfService Plus Vendor— Affected before 6116 Fixed in 6116 Patch available CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*up to 6.0VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:*6.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:*6.1 6100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:*6.1 6101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:*6.1 6102VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:*6.1 6103VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:*6.1 6104VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:*6.1 6105VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:*6.1 6106VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6107:*:*:*:*:*:*6.1 6107VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:* Versions up to 6.0 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:-:*:*:*:*:*:* Versions 6.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6100:*:*:*:*:*:* Versions 6.1 6100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6101:*:*:*:*:*:* Versions 6.1 6101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6102:*:*:*:*:*:* Versions 6.1 6102 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6103:*:*:*:*:*:* Versions 6.1 6103 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6104:*:*:*:*:*:* Versions 6.1 6104 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6105:*:*:*:*:*:* Versions 6.1 6105 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6106:*:*:*:*:*:* Versions 6.1 6106 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6107:*:*:*:*:*:* Versions 6.1 6107 Vulnerable ·Zohocorp
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6108:*:*:*:*:*:*6.1 6108VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6109:*:*:*:*:*:*6.1 6109VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6110:*:*:*:*:*:*6.1 6110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6111:*:*:*:*:*:*6.1 6111VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6112:*:*:*:*:*:*6.1 6112VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6113:*:*:*:*:*:*6.1 6113VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6114:*:*:*:*:*:*6.1 6114VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6115:*:*:*:*:*:*6.1 6115VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6108:*:*:*:*:*:* Versions 6.1 6108 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6109:*:*:*:*:*:* Versions 6.1 6109 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6110:*:*:*:*:*:* Versions 6.1 6110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6111:*:*:*:*:*:* Versions 6.1 6111 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6112:*:*:*:*:*:* Versions 6.1 6112 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6113:*:*:*:*:*:* Versions 6.1 6113 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6114:*:*:*:*:*:* Versions 6.1 6114 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6115:*:*:*:*:*:* Versions 6.1 6115 Vulnerable ·Zohocorp

Remediation

  • Fix · CNA ManageEngine ADSelfService Plus Fixed in 6116

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20147
  2. 2026-10-03 Alias added: GHSA-j385-q64g-xhxj

References

Exploit 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-17574 Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-11432 Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated… KEVCVSS 3.1MEDIUM 6.8
  • TI-2021-09883 Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote… CVSS 3.1CRITICAL 9.8
  • TI-2023-12890 Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a… CVSS 3.1HIGH 7.5
  • TI-2021-12772 A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus… CVSS 3.1HIGH 8.8
See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences