CVE-2021-20147

ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI

published January 3, 2022

CVSS
—
EPSS
7%
Percentile
94.1
In the wild
Unconfirmed
What it is

ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06900 · 94.1th percentile
Published
2022-01-03T21:07Z
EPSS history
Timeline
  • 03 JAN 21:07Z
    ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI
    cvelistv5