PT-2022-24564 · Zoho · Zoho Manageengine Admanager Plus+4
Published
2022-08-29
·
Updated
2022-09-02
·
CVE-2022-38772
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Zoho ManageEngine OpManager versions prior to 125658
Zoho ManageEngine OpManager Plus versions prior to 126003
Zoho ManageEngine OpManager MSP versions prior to 126105
Zoho ManageEngine Network Configuration Manager versions prior to 126120
Zoho ManageEngine NetFlow Analyzer versions prior to 126120
Zoho ManageEngine OpUtils versions prior to 126120
Description
The issue allows authenticated users to make database changes that lead to remote code execution in the NMAP feature. This is due to a command injection vulnerability in the
getNmapInitialOption function.Recommendations
For Zoho ManageEngine OpManager version prior to 125658, update to version 125658 or later.
For Zoho ManageEngine OpManager Plus version prior to 126003, update to version 126003 or later.
For Zoho ManageEngine OpManager MSP version prior to 126105, update to version 126105 or later.
For Zoho ManageEngine Network Configuration Manager version prior to 126120, update to version 126120 or later.
For Zoho ManageEngine NetFlow Analyzer version prior to 126120, update to version 126120 or later.
For Zoho ManageEngine OpUtils version prior to 126120, update to version 126120 or later.
As a temporary workaround, consider disabling the
getNmapInitialOption function until a patch is available.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Zoho Manageengine Netflow Analyzer
Zoho Manageengine Network Configuration Manager
Zoho Manageengine Opmanager
Zoho Manageengine Admanager Plus
Zoho Manageengine Oputils