CVE-2019-3905

Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.

• CWE-918

• https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-3905
• https://www.excellium-services.com/cert-xlm-advisory/cve-2019-3905/Third Party Advisory
• https://www.manageengine.com/products/self-service-password/release-notes.html#5703Release Notes, Vendor Advisory
• https://www.excellium-services.com/cert-xlm-advisory/cve-2019-3905/Third Party Advisory
• https://www.manageengine.com/products/self-service-password/release-notes.html#5703Release Notes, Vendor Advisory

Published

Jan 3, 2019

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3898Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-3899It was found that default configuration of Heketi does not r…9.8
• CVE-2019-3900An infinite loop issue was found in the vhost_net kernel mod…7.7
• CVE-2019-3901A race condition in perf_event_open() allows local attackers…4.7
• CVE-2019-3902A flaw was found in Mercurial before 4.9. It was possible to…5.1
• CVE-2019-3903Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-3906Premisys Identicard version 3.1.190 contains hardcoded crede…8.8
• CVE-2019-3907Premisys Identicard version 3.1.190 stores user credentials …7.5
• CVE-2019-3908Premisys Identicard version 3.1.190 stores backup files as e…7.5
• CVE-2019-3909Premisys Identicard version 3.1.190 database uses default cr…
• CVE-2019-3910Crestron AM-100 before firmware version 1.6.0.2 contains an …
• CVE-2019-3911Reflected cross-site scripting (XSS) vulnerability in LabKey…6.1