Ashley King

This issue allows physically present attackers to execute arbitrary code on affected installations of ManageEngine ADSelfService Plus. Authentication is not required to exploit this issue. The specific flaw exists within the Password Reset Portal used by the GINA client, resulting from the lack of proper authentication of data received via HTTP. An attacker can leverage this issue to bypass authentication and execute code in the context of SYSTEM.

An issue existed in the parsing of URL schemes, which was addressed with improved URL validation. Processing a maliciously crafted URL may lead to an open redirect.

The issue concerns an injection problem that has been addressed through improved validation. Processing a maliciously crafted URL may lead to arbitrary javascript code execution.