CVE-2022-47966

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 99,8%

Kerentanan Improper Input Validation pada zohocorp manageengine access manager plus, zohocorp manageengine ad360 +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 23 Januari 2023, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Rincian

Terbit di NVD

18 Januari 2023

Terakhir diubah

31 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

99,8% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Masuk KEV

23 Januari 2023

Tenggat CISA

13 Februari 2023 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 156 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html patch · advisory vendor
• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-47966 pemerintah AS
• http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.htm... exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-E... exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Ex... exploit · advisory pihak ketiga · vdb entry
• https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis exploit · advisory pihak ketiga
• https://blog.viettelcybersecurity.com/saml-show-stopper/ exploit · advisory pihak ketiga
• https://github.com/horizon3ai/CVE-2022-47966 advisory pihak ketiga
• https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/ exploit · advisory pihak ketiga
• https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6 release notes