TI-2023-17816 Aliases CVE-2023-35719 GHSA-qp6r-4xpp-qr2h

Insufficient verification of data authenticity in ManageEngine ADSelfService Plus

MEDIUM 53CWE-345Published 2023-09-06 · Updated 2024-09-26

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-345.

Summary

ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Password Reset Portal used by the GINA client. The issue results from the lack of proper authentication of data received via HTTP. An attacker can leverage this vulnerability to bypass authentication and execute code in the context of SYSTEM. Was ZDI-CAN-17009.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.24606 97th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ManageEngine	ADSelfService Plus	6.1 Build 6122	—	No fix listed	CNA

ADSelfService Plus VendorManageEngine Affected 6.1 Build 6122 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6122::::::	6.1 6122	Vulnerable	Zohocorp

cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.1:6122:*:*:*:*:*:* Versions 6.1 6122 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-35719
2026-10-03 Alias added: GHSA-qp6r-4xpp-qr2h

References

Advisory 2

TI-2015-06796 The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows… CVSS 3.0CRITICAL 9.8
TI-2014-04325 Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer… CVSS 3.0HIGH 8.8
TI-2017-08514 Path traversal in Zoho ManageEngine ServiceDesk CVSS 3.0HIGH 7.5
TI-2023-25530 Path traversal in ManageEngine OpManager CVSS 3.1CRITICAL 9.1
TI-2025-03383 SQL injection in ManageEngine ADSelfService Plus CVSS 3.1HIGH 8.1
TI-2025-24864 SQL injection in ManageEngine ADAudit Plus CVSS 3.1HIGH 8.3

See all 131 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences