CVE-2022-29081
critical · 9.8A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring.
9.8
CVSS
83.5%
EPSS (exploit prob.)
100th
EPSS percentile
2022-04-28
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| zohocorp | manageengine_access_manager_plus | 4.0 |
| zohocorp | manageengine_access_manager_plus | 4.1 |
| zohocorp | manageengine_access_manager_plus | 4.1 |
| zohocorp | manageengine_access_manager_plus | 4.2 |
| zohocorp | manageengine_access_manager_plus | 4.2 |
| zohocorp | manageengine_access_manager_plus | 4.2 |
| zohocorp | manageengine_access_manager_plus | 4.2 |
| zohocorp | manageengine_access_manager_plus | 4.3 |
| zohocorp | manageengine_access_manager_plus | 4.3 |
| zohocorp | manageengine_pam360 | 4.0 |
| zohocorp | manageengine_pam360 | 4.0 |
| zohocorp | manageengine_pam360 | 4.1 |
| zohocorp | manageengine_pam360 | 4.1 |
| zohocorp | manageengine_pam360 | 4.5 |
| zohocorp | manageengine_pam360 | 4.5 |
| zohocorp | manageengine_pam360 | 5.0 |
| zohocorp | manageengine_pam360 | 5.0 |
| zohocorp | manageengine_pam360 | 5.0 |
| zohocorp | manageengine_pam360 | 5.0 |
| zohocorp | manageengine_pam360 | 5.0 |
| zohocorp | manageengine_pam360 | 5.1 |
| zohocorp | manageengine_pam360 | 5.2 |
| zohocorp | manageengine_pam360 | 5.3 |
| zohocorp | manageengine_pam360 | 5.3 |
| zohocorp | manageengine_pam360 | 5.3 |
| zohocorp | manageengine_pam360 | 5.4 |
| zohocorp | manageengine_password_manager_pro | 10.1 |
| zohocorp | manageengine_password_manager_pro | 10.1 |
| zohocorp | manageengine_password_manager_pro | 10.2 |
| zohocorp | manageengine_password_manager_pro | 10.3 |
| zohocorp | manageengine_password_manager_pro | 10.3 |
| zohocorp | manageengine_password_manager_pro | 10.3 |
| zohocorp | manageengine_password_manager_pro | 10.4 |
| zohocorp | manageengine_password_manager_pro | 10.4 |
| zohocorp | manageengine_password_manager_pro | 10.4 |
| zohocorp | manageengine_password_manager_pro | 11.1 |
| zohocorp | manageengine_password_manager_pro | 11.1 |
| zohocorp | manageengine_password_manager_pro | 11.1 |
| zohocorp | manageengine_password_manager_pro | 11.1 |
| zohocorp | manageengine_password_manager_pro | 11.2 |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-29081