PT-2022-23356 · Zoho · Zoho Manageengine Supportcenter Plus

Raphael Cheneau · Published 2022-07-26 · Updated 2022-08-02 · CVE-2022-36412

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine SupportCenter Plus versions prior to 11023

Description The issue concerns authentication bypass in V3 API requests. This means an API request can be executed with the credentials of a user who authenticated in the past.

Recommendations For versions prior to 11023, update to version 11023 or later to resolve the authentication bypass issue in V3 API requests.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-36412

Affected Products

Zoho Manageengine Supportcenter Plus

References · 4

• https://osv.dev/vulnerability/CVE-2022-36412 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36412 · Security Note
• https://manageengine.com/products/support-center/cve-2022-36412.html · Vendor Advisory
• https://t.me/cibsecurity/46998 · Telegram Post