PT-2022-18683 · Zoho · Zoho Manageengine Opmanager

Anh Vu · Published 2022-04-18 · Updated 2022-04-26 · CVE-2022-27908

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 125588 Zoho ManageEngine OpManager versions prior to 125603

Description The issue concerns an authenticated SQL Injection in the Inventory Reports module.

Recommendations For versions prior to 125588, update to version 125588 or later. For versions prior to 125603, update to version 125603 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-27908

Affected Products

Zoho Manageengine Opmanager

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-27908 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27908 · Vendor Advisory
• https://manageengine.com/network-monitoring/security-updates/cve-2022-27908.html · Vendor Advisory
• https://t.me/cibsecurity/41008 · Telegram Post