CVE-2019-3905

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.

Metrics

CVSS 3.0 10.0/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-3905
https://www.excellium-services.com/cert-xlm-advisory/cve-2019-3905/Third Party Advisory
https://www.manageengine.com/products/self-service-password/release-notes.html#5703Release Notes, Vendor Advisory
https://www.excellium-services.com/cert-xlm-advisory/cve-2019-3905/Third Party Advisory
https://www.manageengine.com/products/self-service-password/release-notes.html#5703Release Notes, Vendor Advisory

Timeline

Published: Jan 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-39068.8Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use CVE-2019-39077.5Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of CVE-2019-39087.5Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An a CVE-2019-39099.8Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor interventio CVE-2019-39109.1Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated CVE-2019-39116.1Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remo CVE-2019-39126.1An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unaut CVE-2019-39134.9Command manipulation in LabKey Server Community Edition before 18.3.0-61806.763 allows an authenticated remote attacker to unmount any drive CVE-2019-39147.2Remote command injection vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows a remote, authenticated a CVE-2019-39157.5Authentication Bypass by Capture-replay vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an unauthe CVE-2019-39167.5Information disclosure vulnerability in Verizon Fios Quantum Gateway (G1100) firmware version 02.01.00.05 allows an remote, unauthenticated CVE-2019-39177.5The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 allows a remote, unauthenticated attacker to enable telnetd on th