CVE-2025-1723CWE-287

Account takeover

High · published March 3, 2025

CVSS v3.1
8.1
EPSS
1%
Percentile
73.6
In the wild
Unconfirmed
What it is

Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01475 · 73.6th percentile
Weakness
CWE-287 · Improper Authentication
Published
2025-03-03T07:40Z
EPSS history
Timeline
  • 03 MAR 07:40Z
    Account takeover
    cvelistv5