9.8Critical
KEV
CVE-2022-35405Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Known exploited — Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
CISA confirmed this vulnerability is used in real attacks on 22.09.2022. Remediation deadline for US federal agencies: 13.10.2022.
Required action: Apply updates per vendor instructions. https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html; https://nvd.nist.gov/vuln/detail/CVE-2022-35405
Description
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
Weakness (CWE):
CWE-502
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| zohocorp | manageengine access manager plus | < 4.3 | |
| zohocorp | manageengine pam360 | < 5.5 | |
| zohocorp | manageengine password manager pro | < 12.1 |
References and patches
- https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html PatchVendor Advisory
- http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35405 US Government Resource
CPE matches (NVD) (8)
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:*:*:*:*:*:*:*:*< 4.3cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:*cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:*cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:*cpe:2.3:a:zohocorp:manageengine_pam360:*:*:*:*:*:*:*:*< 5.5cpe:2.3:a:zohocorp:manageengine_pam360:5.5:build5500:*:*:*:*:*:*cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:*:*:*:*< 12.1cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12100:*:*:*:*:*:*