Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html | Exploit Third Party Advisory VDB Entry |
| https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
08 Aug 2023, 14:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-502 |
05 Nov 2022, 02:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html - Exploit, Third Party Advisory, VDB Entry |
03 Aug 2022, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
29 Jul 2022, 15:10
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Zohocorp manageengine Access Manager Plus
Zohocorp manageengine Password Manager Pro Zohocorp Zohocorp manageengine Pam360 |
|
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_access_manager_plus:*:*:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12100:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_pam360:*:*:*:*:*:*:*:* cpe:2.3:a:zohocorp:manageengine_pam360:5.5:build5500:*:*:*:*:*:* |
|
| References | (MISC) https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html - Patch, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
19 Jul 2022, 15:32
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-07-19 15:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-35405
Mitre link : CVE-2022-35405
CVE.ORG link : CVE-2022-35405
JSON object : View
Products Affected
zohocorp
- manageengine_access_manager_plus
- manageengine_password_manager_pro
- manageengine_pam360
CWE
CWE-502
Deserialization of Untrusted Data