CVE-2018-5353
9.8
CRITICAL · CVSS 3.1 · EPSS 11.1% (pctl 96)
Patch early
EPSS 11.1% — above the 10% action threshold.
Description
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 11.15% — more likely to be exploited than 96% of all CVEs |
| Weakness | CWE-290 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-09-30 |
| Last modified | 2026-07-09 |
Affected (1)
| Vendor | Product |
|---|---|
| zohocorp | manageengine adselfservice plus |
References
→ the Explorer · watch your stack · NVD