Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass vulnerability that could result in remote code execution (RCE).

This vulnerability allows an attacker to gain unauthorized access to the product through REST API endpoints by sending a specially crafted request. This would allow the attacker to carry out subsequent attacks resulting in RCE.

Organization are advised to follow ManageEngine recommendation to identify the affected installation and action for affected and not affected ADSelfService Plus installation.

                                                                                       Table 1: Vulnerability details

                                                                                       Table 2: Vulnerability Versions