CVE-2021-20148

State: Published
Severity: Not scored
Published: Jan 3, 2022
Updated: Aug 3, 2024
Reserved: Dec 17, 2020

Description

ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticating to the service and then sending a request specifying the password policy file of the other domain.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
ManageEngine ADSelfService Plusn/a	< 6116Affected

References

https://www.tenable.com/security/research/tra-2021-52

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.