What’s Vulnerable › Vulnerabilities

CVE-2021-20147

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-01-03 · updated 2026-06-17
• Weakness: CWE-203

Description

ManageEngine ADSelfService Plus below build 6116 contains an observable response discrepancy in the UMCP operation of the ChangePasswordAPI. This allows an unauthenticated remote attacker to determine whether a Windows domain user exists.

Affected products

• ManageEngine ADSelfService Plus: through 6.0; 6.1, 6.1-6100, 6.1-6101, 6.1-6102, 6.1-6103, 6.1-6104 (+11)

References

• https://www.tenable.com/security/research/tra-2021-52
• https://www.tenable.com/security/research/tra-2021-52

Get alerted when CVE-2021-20147 or the next vulnerability affects your stack