CVE-2023-35719

Summary

CVE-2023-35719 is a vulnerability affecting ManageEngine ADSelfService Plus and its GINA client. Attackers can exploit this issue, which involves insufficient data authenticity verification during authentication, to execute arbitrary code without requiring credentials. The flaw is situated in the Password Reset Portal, and it stems from inadequate HTTP data authentication checks. Consequently, attackers can bypass authentication and run code with SYSTEM privileges.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.