CVE-2022-28987

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine ADSelfService Plus versions prior to 6202

Description The issue allows attackers to perform username enumeration via a crafted POST request to "/ServletAPI/accounts/login". This enables attackers to identify valid usernames, potentially leading to further attacks.

Recommendations For versions prior to 6202, update to version 6202 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/ServletAPI/accounts/login" endpoint until a patch is available.