CVE-2022-28987

MEDIUM 5.3CVE-2022-28987 · Published 20/05/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
manageengine adselfservice plus zohocorp	`= 6.1`	No fix yet

Description

Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login.

References

passtheticket/vulnerability-research · Exploit
passtheticket/vulnerability-research · Exploit
manageengine.com/products/self-service-password/advisory/CVE-2022-28987.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free