CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇬🇧 English

CVE-2022-47966

CVSS 9.8v3.1pub. 2023-01-18upd. 2025-10-31

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

oryginał EN

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Zohocorp Manageengine Access Manager Plus
APP
Zohocorp
4.3< 4.3
Zohocorp Manageengine Ad360
APP
Zohocorp
4.3< 4.3
Zohocorp Manageengine Adaudit Plus
APP
Zohocorp
7.0< 7.0
Zohocorp Manageengine Admanager Plus
APP
Zohocorp
7.1< 7.1
Zohocorp Manageengine Adselfservice Plus
APP
Zohocorp
6.2< 6.2
Zohocorp Manageengine Analytics Plus
APP
Zohocorp
5.1< 5.1
Zohocorp Manageengine Application Control Plus
APP
Zohocorp
< 10.1.2220.18
Zohocorp Manageengine Assetexplorer
APP
Zohocorp
6.9< 6.9
Zohocorp Manageengine Browser Security Plus
APP
Zohocorp
< 11.1.2238.6
Zohocorp Manageengine Device Control Plus
APP
Zohocorp
< 10.1.2220.18
Zohocorp Manageengine Endpoint Dlp Plus
APP
Zohocorp
< 10.1.2137.6
Zohocorp Manageengine Key Manager Plus
APP
Zohocorp
6.4< 6.4
Zohocorp Manageengine Os Deployer
APP
Zohocorp
< 1.1.2243.1
Zohocorp Manageengine Pam360
APP
Zohocorp
5.7< 5.7
Zohocorp Manageengine Password Manager Pro
APP
Zohocorp
12.1< 12.1
Zohocorp Manageengine Patch Manager Plus
APP
Zohocorp
< 10.1.2220.18
Zohocorp Manageengine Remote Access Plus
APP
Zohocorp
< 10.1.2228.11
Zohocorp Manageengine Remote Monitoring And Management Central
APP
Zohocorp
< 10.1.41
Zohocorp Manageengine Servicedesk Plus
APP
Zohocorp
14.0< 14.0
Zohocorp Manageengine Servicedesk Plus Msp
APP
Zohocorp
13.0< 13.0
Zohocorp Manageengine Supportcenter Plus
APP
Zohocorp
11.0
Zohocorp Manageengine Vulnerability Manager Plus
APP
Zohocorp
< 10.1.2220.18

CISA KEV — szczegółyi

Dostawcai: Zoho ↗
Produkti: ManageEngine
Data dodania do KEVi: 23 stycznia 2023
Termin remediation (USA)i: 13 lutego 2023(po terminie)
Ransomwarei: Aktywne kampanie ransomware używają tej podatności

🔧Advisory Zoho↗🇺🇸CISA KEV (oryginał)↗

Wymagana akcja (CISA)i

Zastosuj aktualizacje zgodnie z instrukcjami producenta.

tłumaczenie AI

▸ Pokaż oryginał (EN)

Apply updates per vendor instructions.

Opis CISAi

Wiele produktów Zoho ManageEngine zawiera lukę umożliwiającą nieuwierzytelniony zdalny przejęcie kontroli (RCE) z powodu użycia przestarzałej zależności od strony trzeciej, Apache Santuario.

tłumaczenie AI

▸ Pokaż oryginał (EN)

Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.

🔴