CVE-2022-29457

Public PoC / Exploit (2)

Exploit-DBManageEngine ADSelfService Plus Build 6118 - NTLMv2 Hash Exposure TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-522

Affected Products (64)

zohocorp · manageengine_adaudit_plus (up to 7.0.0)vulnerable

zohocorp · manageengine_adaudit_plusvulnerable

zohocorp · manageengine_admanager_plus (up to 7.1)vulnerable

zohocorp · manageengine_admanager_plusvulnerable

zohocorp · manageengine_adselfservice_plus (up to 6.1)vulnerable

zohocorp · manageengine_adselfservice_plusvulnerable

...and 14 more

References (6)

http://packetstormsecurity.com/files/167051/ManageEngine-ADSelfService-Plus-Build-6118-NTLMv2-Hash-Exposure.html

ExploitThird Party AdvisoryVDB Entry

https://docs.unsafe-inline.com/0day/multiple-manageengine-applications-critical-information-disclosure-vulnerability

ExploitPatchThird Party Advisory

https://www.manageengine.com/products/self-service-password/release-notes.html

Release NotesVendor Advisory