CVE-2024-27310
Zohocorp Manageengine Adselfservice Plus ≤ 6.4
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2024-27310 is a medium-severity LDAP Injection (CWE-90) vulnerability in Zohocorp Manageengine Adselfservice Plus. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Zoho ManageEngine ADSelfService Plus versions below 6401 contain a denial-of-service vulnerability triggered by malicious LDAP input. The flaw is tracked as CVE-2024-27310 with a CVSS 3.1 score of 5.3 and is associated with CWE-90 LDAP injection, allowing an attacker to supply crafted input that the application fails to neutralize properly before processing.
An unauthenticated remote attacker can exploit the issue over the network with low complexity by sending specially formed LDAP data, resulting in a denial-of-service condition that affects availability while leaving confidentiality and integrity untouched.
The vendor advisory published at https://www.manageengine.com/products/self-service-password/advisory/CVE-2024-27310.html states that the issue is resolved by upgrading to ADSelfService Plus version 6401 or later. The associated EPSS score has remained flat at 0.0579 with no material increase since disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-24526
Vulnerability Data
Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP input.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.6
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover LDAP injection flaws through static analysis or crafted test cases.
Input validation directly stops untrusted data from reaching an LDAP query builder without neutralization of special characters.
Secure engineering principles require safe query construction and escaping that structurally prevents LDAP injection.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and query parameterization to prevent LDAP injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches LDAP injection via dynamic analysis or fuzzing, but does not prevent it at the source.
Secure development lifecycle mandates input validation and query construction practices that directly prevent LDAP injection.
Application security requirements include explicit rules for safe construction of directory queries, mitigating LDAP injection.
Secure coding standards require proper neutralization of LDAP special characters, directly eliminating this weakness.
Secure architecture principles encourage safe query interfaces but do not prescribe the specific coding controls needed for LDAP injection.
Information access restriction limits who can query LDAP but does not address how queries are built.