Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.
Weakness
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Manageengine_adselfservice_plus | Zohocorp | 5.0-5000 (including) | 5.0-5000 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.0-5001 (including) | 5.0-5001 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.0-5002 (including) | 5.0-5002 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.0-5010 (including) | 5.0-5010 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.0-5011 (including) | 5.0-5011 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.0-5020 (including) | 5.0-5020 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.0-5021 (including) | 5.0-5021 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.0-5022 (including) | 5.0-5022 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.0-5030 (including) | 5.0-5030 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.0-5032 (including) | 5.0-5032 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.0-5040 (including) | 5.0-5040 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.0-5041 (including) | 5.0-5041 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5100 (including) | 5.1-5100 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5101 (including) | 5.1-5101 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5102 (including) | 5.1-5102 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5103 (including) | 5.1-5103 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5104 (including) | 5.1-5104 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5105 (including) | 5.1-5105 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5106 (including) | 5.1-5106 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5107 (including) | 5.1-5107 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5108 (including) | 5.1-5108 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5109 (including) | 5.1-5109 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5110 (including) | 5.1-5110 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5111 (including) | 5.1-5111 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5112 (including) | 5.1-5112 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5113 (including) | 5.1-5113 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5114 (including) | 5.1-5114 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.1-5115 (including) | 5.1-5115 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.2-5200 (including) | 5.2-5200 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.2-5201 (including) | 5.2-5201 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.2-5202 (including) | 5.2-5202 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.2-5203 (including) | 5.2-5203 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.2-5204 (including) | 5.2-5204 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.2-5205 (including) | 5.2-5205 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.2-5206 (including) | 5.2-5206 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.2-5207 (including) | 5.2-5207 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5300 (including) | 5.3-5300 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5301 (including) | 5.3-5301 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5302 (including) | 5.3-5302 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5303 (including) | 5.3-5303 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5304 (including) | 5.3-5304 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5305 (including) | 5.3-5305 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5306 (including) | 5.3-5306 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5307 (including) | 5.3-5307 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5308 (including) | 5.3-5308 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5309 (including) | 5.3-5309 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5310 (including) | 5.3-5310 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5311 (including) | 5.3-5311 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5312 (including) | 5.3-5312 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5313 (including) | 5.3-5313 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5314 (including) | 5.3-5314 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5315 (including) | 5.3-5315 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5316 (including) | 5.3-5316 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5317 (including) | 5.3-5317 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5318 (including) | 5.3-5318 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5319 (including) | 5.3-5319 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5320 (including) | 5.3-5320 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5321 (including) | 5.3-5321 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5322 (including) | 5.3-5322 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5323 (including) | 5.3-5323 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5324 (including) | 5.3-5324 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5325 (including) | 5.3-5325 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5326 (including) | 5.3-5326 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5327 (including) | 5.3-5327 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5328 (including) | 5.3-5328 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5329 (including) | 5.3-5329 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.3-5330 (including) | 5.3-5330 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.4-5400 (including) | 5.4-5400 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5500 (including) | 5.5-5500 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5501 (including) | 5.5-5501 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5502 (including) | 5.5-5502 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5503 (including) | 5.5-5503 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5504 (including) | 5.5-5504 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5505 (including) | 5.5-5505 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5506 (including) | 5.5-5506 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5507 (including) | 5.5-5507 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5508 (including) | 5.5-5508 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5509 (including) | 5.5-5509 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5510 (including) | 5.5-5510 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5511 (including) | 5.5-5511 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5512 (including) | 5.5-5512 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5513 (including) | 5.5-5513 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5514 (including) | 5.5-5514 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5515 (including) | 5.5-5515 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5516 (including) | 5.5-5516 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5517 (including) | 5.5-5517 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5518 (including) | 5.5-5518 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5519 (including) | 5.5-5519 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5520 (including) | 5.5-5520 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.5-5521 (including) | 5.5-5521 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.6-5600 (including) | 5.6-5600 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.6-5601 (including) | 5.6-5601 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.6-5602 (including) | 5.6-5602 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.6-5603 (including) | 5.6-5603 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.6-5604 (including) | 5.6-5604 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.6-5605 (including) | 5.6-5605 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.6-5606 (including) | 5.6-5606 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.6-5607 (including) | 5.6-5607 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.7-5700 (including) | 5.7-5700 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.7-5701 (including) | 5.7-5701 (including) |
| Manageengine_adselfservice_plus | Zohocorp | 5.7-5702 (including) | 5.7-5702 (including) |
Related Attack Patterns
References
- https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-3905
- https://www.excellium-services.com/cert-xlm-advisory/cve-2019-3905/
- https://www.manageengine.com/products/self-service-password/release-notes.html#5703
- https://www.excellium-services.com/cert-xlm-advisory/cve-2019-3905/
- https://www.manageengine.com/products/self-service-password/release-notes.html#5703