Veille CVE
CVE-2022-35405
9.8 Critique Exploitée activementCatalogue CISA KEV — Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
Ajoutée le 22/09/2022 · Échéance de correction (agences US) : 13/10/2022
Action requise : Apply updates per vendor instructions.
Description
Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html ExploitThird Party AdvisoryVDB Entry
- https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html PatchVendor Advisory
- http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html ExploitThird Party AdvisoryVDB Entry
- https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35405 US Government Resource