CVE-2024-0252CWE-94

Remote code execution

High · published January 11, 2024

CVSS v3.1
8.8
EPSS
8%
Percentile
94.7
In the wild
Unconfirmed
What it is

ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.07814 · 94.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-01-11T07:57Z
EPSS history
Timeline
  • 11 JAN 07:57Z
    Remote code execution
    cvelistv5