CVE-2019-7162

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-7162
https://www.excellium-services.com/cert-xlm-advisory
https://www.excellium-services.com/cert-xlm-advisory/cve-2019-7162/Third Party Advisory
https://www.excellium-services.com/cert-xlm-advisory/cve-2019-7162/Third Party Advisory

Timeline

Published: Dec 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-71639.8The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40_LU_02.00_02 devices is vulnerable to an authentication bypass that allows an unauthen CVE-2019-71649.8SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.CVE-2019-71659.8A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.CVE-2019-71677.5Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of p CVE-2019-71684.8A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /ad CVE-2019-71694.8A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a CVE-2019-71704.8A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a CVE-2019-71714.8A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a CVE-2019-71726.1A stored-self XSS exists in ATutor through v2.2.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field t CVE-2019-71734.8A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /a CVE-2019-71749.8Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), fileslist.php (aka Ec CVE-2019-71757.5In ImageMagick before 7.0.8-25, some memory leaks exist in DecodeImage in coders/pcd.c.