CVE-2019-18411

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/aliceicl/e32fb4a17277c7db9e0256185ac03daeThird Party Advisory
https://gist.github.com/aliceicl/e32fb4a17277c7db9e0256185ac03daeThird Party Advisory

Timeline

Published: Nov 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-184127.5JetBrains IDETalk plugin before version 193.4099.10 allows XXE CVE-2019-184139.8In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via CVE-2019-184148.8Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lac CVE-2019-184156.1Sourcecodester Restaurant Management System 1.0 allows XSS via the "send a message" screen.CVE-2019-184166.1Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member.CVE-2019-184178.8Sourcecodester Restaurant Management System 1.0 allows an authenticated attacker to upload arbitrary files that can result in code execution CVE-2019-184189.8clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no se CVE-2019-184196.1A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web sc CVE-2019-18425.4A vulnerability in the Secure Shell (SSH) authentication function of Cisco IOS XR Software could allow an authenticated, remote attacker to CVE-2019-184206.5An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall.CVE-2019-184217.5An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pag CVE-2019-184228.8An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the