FKIE_CVE-2025-11250
Vulnerability from fkie_nvd - Published: 2026-01-13 14:16 - Updated: 2026-01-29 19:12
Severity ?
Summary
Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*",
"matchCriteriaId": "39DC8AD8-D6CC-4B7A-AE11-9351D5A3D3C7",
"versionEndExcluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6500:*:*:*:*:*:*",
"matchCriteriaId": "320659C3-0C56-43D5-A29F-64FDC62B91FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6501:*:*:*:*:*:*",
"matchCriteriaId": "A4713150-31DF-46BB-9F91-11DE18ACCA85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6502:*:*:*:*:*:*",
"matchCriteriaId": "044111C4-C12B-4389-AEA5-78362C997183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6503:*:*:*:*:*:*",
"matchCriteriaId": "F6883E07-C47E-47CA-B013-96A7853E6CDD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6504:*:*:*:*:*:*",
"matchCriteriaId": "3B9EEE99-EDF2-4521-947F-D0DC903C4773",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6505:*:*:*:*:*:*",
"matchCriteriaId": "FFE2422E-71AC-40E6-BFC6-5030A427A3C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6506:*:*:*:*:*:*",
"matchCriteriaId": "2652A735-7EB8-4143-9847-07C35CC7DA05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6507:*:*:*:*:*:*",
"matchCriteriaId": "FDA211A5-74C6-4F04-B2A3-F616DF322308",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6508:*:*:*:*:*:*",
"matchCriteriaId": "7770CE61-3B0D-42E0-952D-660D518CEB12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6509:*:*:*:*:*:*",
"matchCriteriaId": "8FC73F1B-75C0-4D0B-94E4-EAE04390E1FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6510:*:*:*:*:*:*",
"matchCriteriaId": "F1096C37-0401-4377-822F-51E16A062FAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6511:*:*:*:*:*:*",
"matchCriteriaId": "70A1BD2E-FC72-4B59-8249-15F1992145C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6512:*:*:*:*:*:*",
"matchCriteriaId": "80520B90-93FC-4843-AEE8-45A32E99B761",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6513:*:*:*:*:*:*",
"matchCriteriaId": "16736D98-8484-4498-BE7F-FE328285544A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6514:*:*:*:*:*:*",
"matchCriteriaId": "9CAFDB7F-AB08-4063-BAC4-FADB1890DF12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6515:*:*:*:*:*:*",
"matchCriteriaId": "12E5EBFD-57E5-4F76-BACA-06E601F96DA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6516:*:*:*:*:*:*",
"matchCriteriaId": "8621CBB7-3B0E-4076-AFD7-3EE2572EECC9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6517:*:*:*:*:*:*",
"matchCriteriaId": "A62763BA-A1A4-43D6-ADB5-631997936C9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.5:6518:*:*:*:*:*:*",
"matchCriteriaId": "F5E82560-57E8-41F4-BD52-E3C4DDBC9A9F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations."
}
],
"id": "CVE-2025-11250",
"lastModified": "2026-01-29T19:12:29.953",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "0fc0942c-577d-436f-ae8e-945763c79b02",
"type": "Secondary"
}
]
},
"published": "2026-01-13T14:16:36.277",
"references": [
{
"source": "0fc0942c-577d-436f-ae8e-945763c79b02",
"tags": [
"Vendor Advisory",
"Patch"
],
"url": "https://www.manageengine.com/products/self-service-password/advisory/CVE-2025-11250.html"
}
],
"sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-290"
}
],
"source": "0fc0942c-577d-436f-ae8e-945763c79b02",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…