vulnerability
Zoho ManageEngine ADSelfService Plus: Unauthenticated Remote Code Execution RCE Vulnerability (CVE-2021-33055)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 10 | (AV:N/AC:L/Au:N/C:C/I:C/A:C) | 2021-05-26 | 2024-12-18 | 2024-12-18 |
Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
2021-05-26
Added
2024-12-18
Modified
2024-12-18
Description
ADSelfService Plus employs PowerShell scripts to achieve the functionality of features such as password synchronization. Unicodes General Punctuation block contains symbols composed of multiple singlequotes and double-quotes. When these symbols are included in PowerShell scripts, they can be used to begin and end strings. However since these symbols are not considered as Unicode-encoded by PowerShell, they may be misused to perform PowerShell injection attacks.
Solution
zoho-manageengine-adselfservice-plus-upgrade-latest
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.