CVE-2019-18411

    Dashboard / Vulnerabilities / CVE-2019-18411

    CVE-2019-18411

    Published: 6 Nov 2019Last Modified: 10 Mar 2026

    Summary:

    Details: Zoho ManageEngine ADSelfService Plus 5.x through 5803 has CSRF on the users' profile information page. Users who are attacked with this vulnerability will be forced to modify their enrolled information, such as email and mobile phone, unintentionally. Attackers could use the reset password function and control the system to send the authentication code back to the channel that the attackers own.

    References: , https://gist.github.com/aliceicl/e32fb4a17277c7db9e0256185ac03dae

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2019-18411 | CVE-DB