Critical severity · published Jul 19, 2022
CVE-2022-35405
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
In wildKEV
9.8
CVSS
99.9%
EPSS
Yes
On KEV
Description
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.9% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 22, 2022
Federal remediation dueOct 13, 2022
Ransomware campaign useNot known
Affected products
Which versions
MA
ManageEngine ADSelfService Plus · Zoho
All versions, or not specified · source: KEV
MA
Manageengine Access Manager Plus · Zohocorp
before 4.3; 4.3; 4.3; 4.3 · source: NVD
MP
Manageengine Pam360 · Zohocorp
before 5.5; 5.5 · source: NVD
MP
Manageengine Password Manager Pro · Zohocorp
before 12.1; 12.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-35405
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-35405
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html
x_refsource_MISC
http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html
More from ManageEngine ADSelfService Plus
9.8
CVE-2022-47966
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
9.8
CVE-2021-40539
Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability
9.8
CVE-2020-10189
Zoho ManageEngine Desktop Central File Upload Vulnerability
6.8
CVE-2022-28810
Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
6.5
CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability