CVE-2023-35854
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedZoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability."
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceZoho ManageEngine ADSelfService Plus through version 6113 contains an authentication bypass vulnerability that allows attackers to steal domain controller session tokens, enabling identity spoofing and privilege escalation to domain controller administrator privileges.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 6.1= 6.1CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify installed ADSelfService Plus versionAccess the product's About page (typically at /api/info or through the Admin Console > About section), or check the service version information in Windows Services or the product's built-in version checkerAffected if Version is 6.1 or any version below 6.1 (e.g., 6.0, 5.x, etc.)
-
Confirm domain controller integration is activeVerify that ADSelfService Plus is configured to integrate with Active Directory by checking the domain configuration in Admin Console > Domain Settings > Active DirectoryAffected if The product is integrated with Active Directory and syncing or authenticating against domain controllers
-
Assess network exposure of the ADSelfService Plus interfaceReview firewall rules and access control lists to determine if the ADSelfService Plus web portal (ports 8888 or 443 typically) is accessible from untrusted or external networksAffected if The web interface is reachable from networks outside the trusted internal network perimeter
-
Check for existing session token protectionsInspect the product's authentication settings in Admin Console > Configuration > Authentication > Security Settings for any token hardening or session management configurationsAffected if Default or weak session management is in use without additional hardening measures
The environment is affected if ADSelfService Plus version 6.1 or below is installed with Active Directory integration and the interface is accessible from untrusted networks, allowing potential token theft and privilege escalation.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped6.1
Apply vendor patches when available; in the interim, implement network segmentation, restrict access to ADSelfService Plus to trusted networks only, and enforce additional multi-factor authentication layers for administrative access.
Latest available build of ADSelfService Plus (version higher than 6.1 build 6113)
- 1. Verify current ADSelfService Plus build version by accessing the product's 'About' section in the admin console
- 2. Download the latest build of ADSelfService Plus from the official ManageEngine download portal (manageengine.com/products/ad-self-service-plus/)
- 3. Review the release notes for the latest build to confirm inclusion of security fixes
- 4. Create a full backup of the ADSelfService Plus installation directory and database
- 5. Test the upgrade in a non-production environment before deploying to production
- 6. Schedule maintenance window and stop the ADSelfService Plus service
- 7. Run the installer for the latest version, preserving existing configuration settings
- 8. Start the service and verify the admin console is accessible
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation8.0 h
- Implementation16.0 h
- Testing12.0 h
- Review / QA8.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $12,352.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2023-35854 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2023-35854 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data