CVE-2025-3833
Published: 14 May 2025
Summary
CVE-2025-3833 is a high-severity SQL Injection (CWE-89) vulnerability in Zohocorp Manageengine Adselfservice Plus. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior contain an authenticated SQL injection vulnerability in the MFA reports component, tracked as CVE-2025-3833 with a CVSS 3.1 score of 8.1 and classified under CWE-89. The flaw allows network-accessible attackers with low privileges to manipulate database queries without user interaction.
An authenticated attacker can exploit the issue to read or modify sensitive data, achieving high impact on confidentiality and integrity while leaving availability unaffected. Exploitation requires valid credentials but no special conditions beyond network reachability.
The vendor has published an advisory at https://www.manageengine.com/products/self-service-password/advisory/CVE-2025-3833.html that addresses the flaw. EPSS for the CVE rose from lower values to a peak of 0.1023 on 2026-05-20 before receding to the current 0.0513, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-14871
Vulnerability details
Zohocorp ManageEngine ADSelfService Plus versions 6513 and prior are vulnerable to authenticated SQL injection in the MFA reports.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.