CVE-2022-35405

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html	Exploit Third Party Advisory VDB Entry
https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zohocorp:manageengine_access_manager_plus::::::::
	cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300::::::
	cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301::::::
	cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302::::::
	cpe:2.3:a:zohocorp:manageengine_pam360::::::::
	cpe:2.3:a:zohocorp:manageengine_pam360:5.5:build5500::::::
	cpe:2.3:a:zohocorp:manageengine_password_manager_pro::::::::
	cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12100::::::

History

08 Aug 2023, 14:21

Type	Values Removed	Values Added
CWE	~~NVD-CWE-noinfo~~	CWE-502

Information

Published : 2022-07-19 15:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-35405

Mitre link : CVE-2022-35405

CVE.ORG link : CVE-2022-35405

JSON object : View

Products Affected

zohocorp

manageengine_pam360
manageengine_access_manager_plus
manageengine_password_manager_pro

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2022-35405", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-07-19T15:15:08.680", "references": [{"url": "http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)"}, {"lang": "es", "value": "Zoho ManageEngine Password Manager Pro versiones anteriores a 12101 y PAM360 versiones anteriores a 5510, son vulnerables a una ejecuci\u00f3n de c\u00f3digo remota sin autenticaci\u00f3n. (Esto tambi\u00e9n afecta a ManageEngine Access Manager Plus versiones anteriores a 4303 con autenticaci\u00f3n).\n"}], "lastModified": "2023-08-08T14:21:49.707", "cisaActionDue": "2022-10-13", "cisaExploitAdd": "2022-09-22", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zohocorp:manageengine_access_manager_plus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FDF15FF-2561-4139-AC5E-4812584B1B03", "versionEndExcluding": "4.3"}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5DEC045-6A7E-4041-88F8-5ABC4AB51C29"}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "52DDE5D9-28DE-446F-A402-7BE3C33A4B35"}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6E1E4D8-B7F0-4BDB-B5A2-55436BEC85F1"}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_pam360:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "490F58D2-CD6D-4658-965D-F980AA120D1E", "versionEndExcluding": "5.5"}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_pam360:5.5:build5500:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D1A2884-93DD-45FD-8024-81E007AEE787"}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76C7DC97-8BF1-421F-9272-FD301D2D7A3F", "versionEndExcluding": "12.1"}, {"criteria": "cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12100:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BE65B96-74ED-48F1-B86D-CB3387D989CB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability"}