CVE-2022-29081

zohocorp manageengine access manager plus, zohocorp manageengine pam360, zohocorp manageengine password manager pro

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-29081

Katalog CVE

CVSS 9.8 · Critical EPSS 83,5%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada zohocorp manageengine access manager plus, zohocorp manageengine pam360 +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring.

Rincian

Terbit di NVD
28 April 2022
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari)
83,5% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
zohocorp manageengine access manager plus Versi 4.0 build4000
zohocorp manageengine access manager plus Versi 4.1 build4100
zohocorp manageengine access manager plus Versi 4.1 build4101
zohocorp manageengine access manager plus Versi 4.2 build4200
zohocorp manageengine access manager plus Versi 4.2 build4201
zohocorp manageengine access manager plus Versi 4.2 build4202
zohocorp manageengine access manager plus Versi 4.2 build4203
zohocorp manageengine access manager plus Versi 4.3 build4300
zohocorp manageengine access manager plus Versi 4.3 build4301
zohocorp manageengine pam360 Versi 4.0 build4001
zohocorp manageengine pam360 Versi 4.0 build4002
zohocorp manageengine pam360 Versi 4.1 build4100
zohocorp manageengine pam360 Versi 4.1 build4101
zohocorp manageengine pam360 Versi 4.5 build4500
zohocorp manageengine pam360 Versi 4.5 build4501
zohocorp manageengine pam360 Versi 5.0 build5000
zohocorp manageengine pam360 Versi 5.0 build5001
zohocorp manageengine pam360 Versi 5.0 build5002
zohocorp manageengine pam360 Versi 5.0 build5003
zohocorp manageengine pam360 Versi 5.0 build5004
zohocorp manageengine pam360 Versi 5.1 build5100
zohocorp manageengine pam360 Versi 5.2 build5200
zohocorp manageengine pam360 Versi 5.3 build5300
zohocorp manageengine pam360 Versi 5.3 build5301
zohocorp manageengine pam360 Versi 5.3 build5302
zohocorp manageengine pam360 Versi 5.4 build5400
zohocorp manageengine password manager pro Versi 10.1 build10103
zohocorp manageengine password manager pro Versi 10.1 build10104
zohocorp manageengine password manager pro Versi 10.2 build10200
zohocorp manageengine password manager pro Versi 10.3 build10300
zohocorp manageengine password manager pro Versi 10.3 build10301
zohocorp manageengine password manager pro Versi 10.3 build10302
zohocorp manageengine password manager pro Versi 10.4 build10400
zohocorp manageengine password manager pro Versi 10.4 build10401
zohocorp manageengine password manager pro Versi 10.4 build10402
zohocorp manageengine password manager pro Versi 11.1 11104
zohocorp manageengine password manager pro Versi 11.1 build_11101
zohocorp manageengine password manager pro Versi 11.1 build_11102
zohocorp manageengine password manager pro Versi 11.1 build_11103
zohocorp manageengine password manager pro Versi 11.2 build11200
zohocorp manageengine password manager pro Versi 11.2 build11201
zohocorp manageengine password manager pro Versi 11.3 build11300
zohocorp manageengine password manager pro Versi 11.3 build11301
zohocorp manageengine password manager pro Versi 12.0 build12000
zohocorp manageengine password manager pro Versi 12.0 build12001
zohocorp manageengine password manager pro Versi 12.0 build12002
zohocorp manageengine password manager pro Versi 12.0 build12003
zohocorp manageengine password manager pro Versi 12.0 build12004
zohocorp manageengine password manager pro Versi 12.0 build12005
zohocorp manageengine password manager pro Versi 12.0 build12006

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.