Vulnerability record · CVE-2023-28342 · published 5 April 2023
CVE-2023-28342: Zoho ManageEngine ADSelfService Plus mobile API denial of service
Zohocorp · Manageengine Adselfservice Plus
Zoho ManageEngine ADSelfService Plus before build 6218 allows an unauthenticated attacker to cause a denial of service through the Mobile App Authentication API. The flaw is an uncontrolled resource consumption issue (CWE-400), so a remote attacker can exhaust server resources and disrupt the self-service password and authentication service.
Description
Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityUnauthenticated remote denial of service with a high CVSS score and very high EPSS, though no known exploitation or KEV listing.
What it is
Zoho ManageEngine ADSelfService Plus before build 6218 allows an unauthenticated attacker to cause a denial of service through the Mobile App Authentication API. The flaw is an uncontrolled resource consumption issue (CWE-400), so a remote attacker can exhaust server resources and disrupt the self-service password and authentication service.
Impact
An attacker can degrade or take down the ADSelfService Plus service, blocking password resets and authentication for legitimate users. No data confidentiality or integrity loss is expected; the impact is availability only.
Attack surface
Reachable over the network through the Mobile App Authentication API, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is very high (0.783 probability, 99.6th percentile), indicating elevated likelihood of attempted exploitation, though the record contains no public exploit reference.
What to do
- Upgrade ADSelfService Plus to build 6218 or later, following the vendor advisory.
- If immediate patching is not possible, restrict network access to the Mobile App Authentication API to trusted sources.
- Monitor and rate-limit requests to the mobile authentication endpoint at the reverse proxy or WAF.
- Review server resource baselines and alert on abnormal CPU, memory or connection spikes on the ADSelfService Plus host.
Detection
- Alert on request-rate spikes or unusual volumes against the Mobile App Authentication API.
- Monitor ADSelfService Plus host for CPU, memory and connection exhaustion events.
- Correlate service unavailability or restart events with bursts of mobile API traffic.
- Review web/proxy logs for repeated unauthenticated calls to the mobile authentication endpoint from single sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://manageengine.com | Product |
| https://www.manageengine.com/products/self-service-password/advisory/CVE-2023-28342.html | Vendor Advisory |
| https://manageengine.com | Product |
| https://www.manageengine.com/products/self-service-password/advisory/CVE-2023-28342.html | Vendor Advisory |
Track CVE-2023-28342 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-28342), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
