CVE-2024-0252
Remote code execution
- State
- Published
- Severity
- 8.8 High
- Published
- Jan 11, 2024
- Updated
- Jun 17, 2025
- Reserved
- Jan 5, 2024
Description
ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper handling in the load balancer component. Authentication is required in order to exploit this vulnerability.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | ManageEngine |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
ADSelfService PlusManageEngine |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.