CVE-2022-35405

CRITICALCISA KEV

9.8

Beschreibung

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht7/19/2022

Zuletzt geandert10/31/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerZoho

ProduktManageEngine

SchwachstellennameZoho ManageEngine Multiple Products Remote Code Execution Vulnerability

KEV Aufnahmedatum2022-09-22

Behebungsfrist2022-10-13

Ransomware-NutzungUnknown

Betroffene Produkte

zohocorp:manageengine_access_manager_pluszohocorp:manageengine_pam360zohocorp:manageengine_password_manager_pro

Schwachen (CWE)

CWE-502CWE-502

Referenzen

http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html(cve@mitre.org)

https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html(cve@mitre.org)

http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35405(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.