PT-2022-22806 · Zoho · Manageengine Password Manager Pro+1

Published 2022-07-18 · Updated 2023-08-08 · CVE-2022-35404

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions ManageEngine Password Manager Pro versions 12100 and prior ManageEngine OPManager versions 126100 and prior

Description The issue allows for unauthorized file and directory creation on a server machine.

Recommendations For ManageEngine Password Manager Pro versions 12100 and prior, update to a version later than 12100 to resolve the issue. For ManageEngine OPManager versions 126100 and prior, update to a version later than 126100 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-35404

Affected Products

Manageengine Opmanager

Manageengine Password Manager Pro

References · 6

• https://manageengine.com/itom/advisory/cve-2022-35404.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35404 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35404 · Vendor Advisory
• https://manageengine.com · Vendor Advisory
• https://t.me/cibsecurity/46446 · Telegram Post
• https://t.me/cvenotify/33289 · Telegram Post