CVE-2021-20147

5.3 mediumEPSS 7.1%

Medium (5.3) in zohocorp manageengine adselfservice plus. EPSS 7.1% chance of exploitation in the next 30 days.

ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 7.1% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWE: CWE-203
Published: 2022-01-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zohocorp:manageengine_adselfservice_plus

References

https://www.tenable.com/security/research/tra-2021-52
https://www.tenable.com/security/research/tra-2021-52

Check your stack JSON