| ID | CVE-2022-28810 | ||||||
| Sažetak | Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field. | ||||||
| Reference |
|
||||||
| CVSS |
|
||||||
| Pristup |
|
||||||
| Impact |
|
||||||
| CVSS vektor | AV:N/AC:H/Au:S/C:C/I:C/A:C | ||||||
| Zadnje važnije ažuriranje | 27-03-2025 - 13:58 | ||||||
| Objavljeno | 18-04-2022 - 13:15 |
