CVE-2019-7161

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-7161
https://www.excellium-services.com/cert-xlm-advisory
https://www.excellium-services.com/cert-xlm-advisory/cve-2019-7161/Third Party Advisory
https://www.manageengine.com/products/self-service-password/release-notes.htmlPatch, Release Notes, Vendor Advisory
https://www.excellium-services.com/cert-xlm-advisory/cve-2019-7161/Third Party Advisory
https://www.manageengine.com/products/self-service-password/release-notes.htmlPatch, Release Notes, Vendor Advisory

Timeline

Published: Mar 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-71629.1An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retri CVE-2019-71639.8The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40_LU_02.00_02 devices is vulnerable to an authentication bypass that allows an unauthen CVE-2019-71649.8SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.CVE-2019-71659.8A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.CVE-2019-71677.5Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of p CVE-2019-71684.8A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /ad CVE-2019-71694.8A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a CVE-2019-71704.8A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a CVE-2019-71714.8A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a CVE-2019-71726.1A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field t CVE-2019-71734.8A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a CVE-2019-71749.8Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Ec