An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7161
Reference (s):
- https://www.manageengine.com/products/self-service-password/release-notes.html
- https://www.excellium-services.com/cert-xlm-advisory/cve-2019-7161/