CVE-2024-27310 DOS Vulnerability
Attackers can cause a denial of service in ManageEngine ADSelfService Plus by sending malicious LDAP input, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-27310?
CVE-2024-27310 is a medium-severity denial of service vulnerability in Zohocorp Manageengine Adselfservice Plus, published on 27 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP input.
Weakness: CWE-90
Which versions are affected by CVE-2024-27310?
It affects 1 product.
Products include Zohocorp Manageengine Adselfservice Plus.
How do I fix CVE-2024-27310?
No fix has been published for CVE-2024-27310 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-27310 being exploited?
There is no known exploitation of CVE-2024-27310 in the wild and no public exploit code.
Other vulnerabilities in Zohocorp Manageengine Adselfservice Plus
- CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Authentication Bypass
- CVE-2022-28810 Zoho ManageEngine ADSelfService Plus Remote Code Execution
- CVE-2019-3905 Server-side request forgery in n/a
- CVE-2023-35854 Auth bypass in n/a
- CVE-2021-37422 SQL injection in n/a
All Zohocorp Manageengine Adselfservice Plus vulnerabilities