by Kastro
Paper/Archive/CVE-2022-35405

CVE-2022-35405

Zoho ManageEngine — Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

KEV · due 13 OctEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refmanageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.htmlrefpacketstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35405kevcisa.gov/known-exploited-vulnerabilities-catalog