CVE-2022-35405

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 99,9%

Kerentanan Deserialization of Untrusted Data pada zohocorp manageengine access manager plus, zohocorp manageengine pam360 +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 22 September 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Rincian

Terbit di NVD

19 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

99,9% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Masuk KEV

22 September 2022

Tenggat CISA

13 Oktober 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35405 pemerintah AS
• http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html exploit · advisory pihak ketiga · vdb entry