CVE-2021-20147

PoC —

CVSS 3.1

5.3 medium

EPSS

7%p94

Published

Jan 3, 2022 (Jan 3, 2022)

Modified

Jun 17, 2026

Description

ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.

Vendors: zohocorp
Products: manageengine adselfservice plus
Weakness: CWE-203
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (6.9%)

In the news0 stories

No ingested article mentions this CVE yet.