Cyber Resilience

CVE-2024-27310

Zohocorp Manageengine Adselfservice Plus ≤ 6.4

Published
27 May 2024
Modified
27 November 2024
Patch / advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.023 82th percentile
Risk Priority 51 floored blend · peak EPSS

Summary

CVE-2024-27310 is a medium-severity LDAP Injection (CWE-90) vulnerability in Zohocorp Manageengine Adselfservice Plus. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Zoho ManageEngine ADSelfService Plus versions below 6401 contain a denial-of-service vulnerability triggered by malicious LDAP input. The flaw is tracked as CVE-2024-27310 with a CVSS 3.1 score of 5.3 and is associated with CWE-90 LDAP injection, allowing an attacker to supply crafted input that the application fails to neutralize properly before processing.

An unauthenticated remote attacker can exploit the issue over the network with low complexity by sending specially formed LDAP data, resulting in a denial-of-service condition that affects availability while leaving confidentiality and integrity untouched.

The vendor advisory published at https://www.manageengine.com/products/self-service-password/advisory/CVE-2024-27310.html states that the issue is resolved by upgrading to ADSelfService Plus version 6401 or later. The associated EPSS score has remained flat at 0.0579 with no material increase since disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP input.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-3833Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2023-35854Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2021-28958Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2025-1723Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2022-28810Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2024-0252Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2025-11250Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2021-33256Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2021-40539Same product: Zohocorp Manageengine Adselfservice Plus
CVE-2023-35719Same product: Zohocorp Manageengine Adselfservice Plus

Affected Assets

zohocorp
manageengine adselfservice plus
6.4 · ≤ 6.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.2.6

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation can discover LDAP injection flaws through static analysis or crafted test cases.

Input validation directly stops untrusted data from reaching an LDAP query builder without neutralization of special characters.

Secure engineering principles require safe query construction and escaping that structurally prevents LDAP injection.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input neutralization and query parameterization to prevent LDAP injection.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development catches LDAP injection via dynamic analysis or fuzzing, but does not prevent it at the source.

prevents

Secure development lifecycle mandates input validation and query construction practices that directly prevent LDAP injection.

prevents

Application security requirements include explicit rules for safe construction of directory queries, mitigating LDAP injection.

prevents

Secure coding standards require proper neutralization of LDAP special characters, directly eliminating this weakness.

mitigates

Secure architecture principles encourage safe query interfaces but do not prescribe the specific coding controls needed for LDAP injection.

none

Information access restriction limits who can query LDAP but does not address how queries are built.

References