What is CVE-2019-18411?

CVE-2019-18411 is a high-severity vulnerability in Zohocorp Manageengine Adselfservice Plus, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2019-11-06.

How severe is CVE-2019-18411?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2019-18411 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

CSRF in Zohocorp Manageengine Adselfservice Plus

CVE-2019-18411

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.023 (81.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Zohocorp Manageengine_adselfservice_plus — versions 5.0, 5.1, 5.2
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

Public proof-of-concept exploits

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-18411?: CVE-2019-18411 is a high-severity vulnerability in Zohocorp Manageengine Adselfservice Plus, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2019-11-06.
How severe is CVE-2019-18411?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2019-18411 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.