CVE-2018-5353
Estado: ModificadaCrítica (9.8)—💥 PoC
The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 11%
- Percentil entre todas las CVEs puntuadas: 96
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Prueba de concepto en GitHub (no verificada) · Lista de pruebas de concepto en GitHub
⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.
Tecnologías afectadas (1)
CWE
- CWE-290
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2018-5353",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2020-09-30T18:15:15.927",
"references": [
{
"url": "https://github.com/missing0x00/CVE-2018-5353",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.manageengine.com/products/self-service-password/release-notes.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://github.com/missing0x00/CVE-2018-5353",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.manageengine.com/products/self-service-password/release-notes.html",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-290"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required"
},
{
"lang": "es",
"value": "El módulo GINA/CP personalizado en Zoho ManageEngine ADSelfService Plus versiones anteriores a 5.5 build 5517, permite a atacantes remotos ejecutar código y escalar privilegios mediante una suplantación de identidad. No autentica el servidor deseado antes de abrir una ventana del navegador. Un atacante no autenticado capaz de llevar a cabo un ataque de suplantación de identidad puede redireccionar el navegador para que se ejecute en el contexto del proceso WinLogon.exe. Si no se aplica la autenticación a nivel de red, la vulnerabilidad puede ser explotada mediante RDP. Además, si el servidor web tiene un certificado configurado inapropiadamente, no se requiere ningún ataque de suplantación de identidad"
}
],
"lastModified": "2026-07-09T00:16:50.177",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E862E48C-8EC8-477D-ACF9-5FFFAD844D39",
"versionEndExcluding": "5.5"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7C6C9325-7A0B-4CFF-BBFB-39C1C6F7B0E8"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5500:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B71FA9F-0FC4-4D12-B595-AC529878BC7E"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5501:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E9B5A2E3-4F3D-48CC-A2F0-65B9AD2530F9"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5502:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0979E79B-936C-4787-8E0A-9F7F43A8A748"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5503:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "673E69A8-71BA-49EC-B1AE-931736C6BF42"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5504:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "141FB02E-695F-484E-8FF6-C334C11F7CCD"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5505:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3CF5C1A-6C97-47BA-BF7E-977E3C938DA6"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5506:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "79BEA328-C2CB-4CFA-8CF8-C8B70A37DF07"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5507:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "942DC320-20A3-4CBF-BF94-390A9163FC02"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5508:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A42F5F45-4BF6-4076-AC36-F3EDDAC665A4"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5509:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "600E4C41-B1E1-468D-BA1A-489D0CE5F565"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5510:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CE3BE5B8-37E1-4BB9-A59E-9F3F36BABDA5"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5511:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E41D8FA9-5D9D-4102-B117-40354F847403"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5512:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E620B19-0286-4723-91C4-848B6C453509"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5513:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9274C66F-E6AA-4ABD-BF52-3BCCA75821EB"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5514:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7D6AFFF-645C-42D0-ADC9-9D4852B0E5C1"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5515:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E7A0FC78-73CE-48CE-BD68-74C095F5B052"
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:5.5:5516:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "74D85A59-40DE-4DF6-8F41-53BC9EF56DFC"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}