ManageEngine ADSelfService Plus Default Administrator Credentials

high Nessus Plugin ID 56510

Language:

Synopsis

A web application running on the remote web server is protected using default administrative credentials.

Description

The instance of ManageEngine ADSelfService Plus running on the remote web server uses a default set of credentials ('admin' / 'admin') to control access to its management interface. A remote attacker can exploit this to gain full administrative access to the application.

Solution

Log into the application and use the 'Personalize' feature to change the default login credentials.

Plugin Details

Severity: High

ID: 56510

File Name: manageengine_adselfservice_default_creds.nasl

Version: 1.11

Type: remote

Family: CGI abuses

Published: 10/14/2011

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:zohocorp:manageengine_adselfservice_plus

Required KB Items: installed_sw/ManageEngine ADSelfService Plus

Excluded KB Items: global_settings/supplied_logins_only

Detections

Analytics