| Package | Affected versions | Patched versions |
|---|---|---|
| manageengine adselfservice plus | = 6.1≤ 6.0 |
ManageEngine ADSelfService Plus below build 6116 stores the password policy file for each domain under the html/ web root with a predictable filename based on the domain name. When ADSSP is configured with multiple Windows domains, a user from one domain can obtain the password policy for another domain by authenticating to the service and then sending a request specifying the password policy file of the other domain.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free