CVE-2022-35405
critical · 9.8Actively exploitedOn the CISA Known Exploited Vulnerabilities catalog
Apply updates per vendor instructions.
Added 2022-09-22Remediation due 2022-10-13
A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
9.8
CVSS
99.9%
EPSS (exploit prob.)
100th
EPSS percentile
2022-07-19
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| zohocorp | manageengine_access_manager_plus | < 4.3 |
| zohocorp | manageengine_access_manager_plus | 4.3 |
| zohocorp | manageengine_access_manager_plus | 4.3 |
| zohocorp | manageengine_access_manager_plus | 4.3 |
| zohocorp | manageengine_pam360 | < 5.5 |
| zohocorp | manageengine_pam360 | 5.5 |
| zohocorp | manageengine_password_manager_pro | < 12.1 |
| zohocorp | manageengine_password_manager_pro | 12.1 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html
- https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html
- http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html
- https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35405
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-35405