Executive brief
Multiple Zoho ManageEngine on-premise products are vulnerable to unauthenticated remote code execution due to the use of an outdated Apache Santuario xmlsec library. The vulnerability is exploitable if SAML SSO has been configured, allowing attackers to execute arbitrary code via malicious XML signatures.
Affected products
- Zoho ManageEngine Access Manager Plus before 4308
- Zoho ManageEngine Active Directory 360 before 4310
- Zoho ManageEngine ADAudit Plus before 7081
- Zoho ManageEngine ADManager Plus before 7162
- Zoho ManageEngine ADSelfService Plus before 6211
- Zoho ManageEngine Analytics Plus before 5150
- Zoho ManageEngine Application Control Plus before 10.1.2220.18
- Zoho ManageEngine Asset Explorer before 6983
- Zoho ManageEngine Browser Security Plus before 11.1.2238.6
- Zoho ManageEngine Device Control Plus before 10.1.2220.18
- Zoho ManageEngine Endpoint Central before 10.1.2228.11
- Zoho ManageEngine Endpoint Central MSP before 10.1.2228.11
- Zoho ManageEngine Endpoint DLP before 10.1.2137.6
- Zoho ManageEngine Key Manager Plus before 6401
- Zoho ManageEngine OS Deployer before 1.1.2243.1
- Zoho ManageEngine PAM 360 before 5713
- Zoho ManageEngine Password Manager Pro before 12124
- Zoho ManageEngine Patch Manager Plus before 10.1.2220.18
- Zoho ManageEngine Remote Access Plus before 10.1.2228.11
- Zoho ManageEngine Remote Monitoring and Management (RMM) before 10.1.41
- Zoho ManageEngine ServiceDesk Plus before 14004
- Zoho ManageEngine ServiceDesk Plus MSP before 13001
- Zoho ManageEngine SupportCenter Plus before 11026
- Zoho ManageEngine Vulnerability Manager Plus before 10.1.2220.18
Timeline
- 2023-01-23: disclosed
- 2023-01-23: kev added: Added to CISA Known Exploited Vulnerabilities Catalog