Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-47966

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Published

2023-01-18T18:15:10.570

Last Modified

2025-03-07T21:04:52.037

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses

Type: Primary
NVD-CWE-noinfo
Type: Secondary
CWE-20

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	zohocorp	manageengine_access_manager_plus	< 4.3	Yes
Application	zohocorp	manageengine_access_manager_plus	4.3	Yes
Application	zohocorp	manageengine_access_manager_plus	4.3	Yes
Application	zohocorp	manageengine_access_manager_plus	4.3	Yes
Application	zohocorp	manageengine_access_manager_plus	4.3	Yes
Application	zohocorp	manageengine_access_manager_plus	4.3	Yes
Application	zohocorp	manageengine_access_manager_plus	4.3	Yes
Application	zohocorp	manageengine_access_manager_plus	4.3	Yes
Application	zohocorp	manageengine_access_manager_plus	4.3	Yes
Application	zohocorp	manageengine_ad360	< 4.3	Yes
Application	zohocorp	manageengine_ad360	4.3	Yes
Application	zohocorp	manageengine_ad360	4.3	Yes
Application	zohocorp	manageengine_ad360	4.3	Yes
Application	zohocorp	manageengine_ad360	4.3	Yes
Application	zohocorp	manageengine_ad360	4.3	Yes
Application	zohocorp	manageengine_ad360	4.3	Yes
Application	zohocorp	manageengine_ad360	4.3	Yes
Application	zohocorp	manageengine_ad360	4.3	Yes
Application	zohocorp	manageengine_adaudit_plus	< 7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_adaudit_plus	7.0	Yes
Application	zohocorp	manageengine_admanager_plus	< 7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_admanager_plus	7.1	Yes
Application	zohocorp	manageengine_adselfservice_plus	< 6.2	Yes
Application	zohocorp	manageengine_adselfservice_plus	6.2	Yes
Application	zohocorp	manageengine_adselfservice_plus	6.2	Yes
Application	zohocorp	manageengine_adselfservice_plus	6.2	Yes
Application	zohocorp	manageengine_adselfservice_plus	6.2	Yes
Application	zohocorp	manageengine_adselfservice_plus	6.2	Yes
Application	zohocorp	manageengine_adselfservice_plus	6.2	Yes
Application	zohocorp	manageengine_adselfservice_plus	6.2	Yes
Application	zohocorp	manageengine_adselfservice_plus	6.2	Yes
Application	zohocorp	manageengine_adselfservice_plus	6.2	Yes
Application	zohocorp	manageengine_adselfservice_plus	6.2	Yes
Application	zohocorp	manageengine_adselfservice_plus	6.2	Yes
Application	zohocorp	manageengine_analytics_plus	< 5.1	Yes
Application	zohocorp	manageengine_analytics_plus	5.1	Yes
Application	zohocorp	manageengine_analytics_plus	5.1	Yes
Application	zohocorp	manageengine_analytics_plus	5.1	Yes
Application	zohocorp	manageengine_analytics_plus	5.1	Yes
Application	zohocorp	manageengine_analytics_plus	5.1	Yes
Application	zohocorp	manageengine_analytics_plus	5.1	Yes
Application	zohocorp	manageengine_assetexplorer	< 6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_assetexplorer	6.9	Yes
Application	zohocorp	manageengine_key_manager_plus	< 6.4	Yes
Application	zohocorp	manageengine_key_manager_plus	6.4	Yes
Application	zohocorp	manageengine_pam360	< 5.7	Yes
Application	zohocorp	manageengine_pam360	5.7	Yes
Application	zohocorp	manageengine_pam360	5.7	Yes
Application	zohocorp	manageengine_pam360	5.7	Yes
Application	zohocorp	manageengine_pam360	5.7	Yes
Application	zohocorp	manageengine_password_manager_pro	< 12.1	Yes
Application	zohocorp	manageengine_password_manager_pro	12.1	Yes
Application	zohocorp	manageengine_password_manager_pro	12.1	Yes
Application	zohocorp	manageengine_password_manager_pro	12.1	Yes
Application	zohocorp	manageengine_password_manager_pro	12.1	Yes
Application	zohocorp	manageengine_password_manager_pro	12.1	Yes
Application	zohocorp	manageengine_password_manager_pro	12.1	Yes
Application	zohocorp	manageengine_password_manager_pro	12.1	Yes
Application	zohocorp	manageengine_servicedesk_plus	< 14.0	Yes
Application	zohocorp	manageengine_servicedesk_plus	14.0	Yes
Application	zohocorp	manageengine_servicedesk_plus	14.0	Yes
Application	zohocorp	manageengine_servicedesk_plus	14.0	Yes
Application	zohocorp	manageengine_servicedesk_plus	14.0	Yes
Application	zohocorp	manageengine_servicedesk_plus_msp	< 13.0	Yes
Application	zohocorp	manageengine_servicedesk_plus_msp	13.0	Yes
Application	zohocorp	manageengine_supportcenter_plus	11.0	Yes
Application	zohocorp	manageengine_supportcenter_plus	11.0	Yes
Application	zohocorp	manageengine_supportcenter_plus	11.0	Yes
Application	zohocorp	manageengine_supportcenter_plus	11.0	Yes
Application	zohocorp	manageengine_supportcenter_plus	11.0	Yes
Application	zohocorp	manageengine_supportcenter_plus	11.0	Yes
Application	zohocorp	manageengine_supportcenter_plus	11.0	Yes
Application	zohocorp	manageengine_supportcenter_plus	11.0	Yes
Application	zohocorp	manageengine_application_control_plus	< 10.1.220.18	Yes
Application	zohocorp	manageengine_browser_security_plus	< 11.1.2238.6	Yes
Application	zohocorp	manageengine_device_control_plus	< 10.1.2220.18	Yes
Application	zohocorp	manageengine_endpoint_dlp_plus	< 10.1.2137.6	Yes
Application	zohocorp	manageengine_os_deployer	< 1.1.2243.1	Yes
Application	zohocorp	manageengine_patch_manager_plus	< 10.1.2220.18	Yes
Application	zohocorp	manageengine_remote_access_plus	< 10.1.2228.11	Yes
Application	zohocorp	manageengine_remote_monitoring_and_management_central	< 10.1.41	Yes
Application	zohocorp	manageengine_vulnerability_manager_plus	< 10.1.2220.18	Yes

References

http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry ([email protected])
http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry ([email protected])
http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry ([email protected])
https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis Exploit, Third Party Advisory ([email protected])
https://blog.viettelcybersecurity.com/saml-show-stopper/ Exploit, Third Party Advisory ([email protected])
https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6 Release Notes ([email protected])
https://github.com/horizon3ai/CVE-2022-47966 Third Party Advisory ([email protected])
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a Third Party Advisory, US Government Resource ([email protected])
https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/ Exploit, Third Party Advisory ([email protected])
https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html Patch, Vendor Advisory ([email protected])
http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://blog.viettelcybersecurity.com/saml-show-stopper/ Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6 Release Notes (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/horizon3ai/CVE-2022-47966 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/ Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)