Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-35405

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Published

2022-07-19T15:15:08.680

Last Modified

2025-03-27T13:59:59.140

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses

Type: Primary
CWE-502
Type: Secondary
CWE-502

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	zohocorp	manageengine_access_manager_plus	< 4.3	Yes
Application	zohocorp	manageengine_access_manager_plus	4.3	Yes
Application	zohocorp	manageengine_access_manager_plus	4.3	Yes
Application	zohocorp	manageengine_access_manager_plus	4.3	Yes
Application	zohocorp	manageengine_pam360	< 5.5	Yes
Application	zohocorp	manageengine_pam360	5.5	Yes
Application	zohocorp	manageengine_password_manager_pro	< 12.1	Yes
Application	zohocorp	manageengine_password_manager_pro	12.1	Yes

References

http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html Exploit, Third Party Advisory, VDB Entry ([email protected])
https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html Patch, Vendor Advisory ([email protected])
http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)