CVE-2022-47966: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

CVE-2022-47966 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2023-01-23

Multiple Zoho ManageEngine on-premise products are vulnerable to unauthenticated remote code execution due to the use of an outdated Apache Santuario xmlsec library. The vulnerability is exploitable if SAML SSO has been configured, allowing attackers to execute arbitrary code via malicious XML signatures.

Technologies: Zoho ManageEngine. Vendors: Zoho.

Quick answers

Is CVE-2022-47966 exploited in the wild?
Yes. CVE-2022-47966 is known to be exploited in the wild, first recorded on 23 January 2023. Treat it as urgent.
How severe is CVE-2022-47966?
Critical severity, with a CVSS score of 9.8, published 23 January 2023.
Which products and versions are affected?
Zoho ManageEngine Access Manager Plus before 4308; Zoho ManageEngine Active Directory 360 before 4310; Zoho ManageEngine ADAudit Plus before 7081; Zoho ManageEngine ADManager Plus before 7162; and 20 more.
Is there a fix for CVE-2022-47966?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2022-47966 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2022-47966?
Check whether you run Zoho ManageEngine. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Zoho ManageEngine Access Manager Plus before 4308
  • Zoho ManageEngine Active Directory 360 before 4310
  • Zoho ManageEngine ADAudit Plus before 7081
  • Zoho ManageEngine ADManager Plus before 7162
  • Zoho ManageEngine ADSelfService Plus before 6211
  • Zoho ManageEngine Analytics Plus before 5150
  • Zoho ManageEngine Application Control Plus before 10.1.2220.18
  • Zoho ManageEngine Asset Explorer before 6983
  • Zoho ManageEngine Browser Security Plus before 11.1.2238.6
  • Zoho ManageEngine Device Control Plus before 10.1.2220.18
  • Zoho ManageEngine Endpoint Central before 10.1.2228.11
  • Zoho ManageEngine Endpoint Central MSP before 10.1.2228.11
  • Zoho ManageEngine Endpoint DLP before 10.1.2137.6
  • Zoho ManageEngine Key Manager Plus before 6401
  • Zoho ManageEngine OS Deployer before 1.1.2243.1
  • Zoho ManageEngine PAM 360 before 5713
  • Zoho ManageEngine Password Manager Pro before 12124
  • Zoho ManageEngine Patch Manager Plus before 10.1.2220.18
  • Zoho ManageEngine Remote Access Plus before 10.1.2228.11
  • Zoho ManageEngine Remote Monitoring and Management (RMM) before 10.1.41
  • Zoho ManageEngine ServiceDesk Plus before 14004
  • Zoho ManageEngine ServiceDesk Plus MSP before 13001
  • Zoho ManageEngine SupportCenter Plus before 11026
  • Zoho ManageEngine Vulnerability Manager Plus before 10.1.2220.18

Timeline

  • 2023-01-23: disclosed
  • 2023-01-23: kev added: Added to CISA Known Exploited Vulnerabilities Catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.