PT-2022-24564 · Zoho · Zoho Manageengine Admanager Plus+4

Published

2022-08-29

·

Updated

2022-09-02

·

CVE-2022-38772

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 125658 Zoho ManageEngine OpManager Plus versions prior to 126003 Zoho ManageEngine OpManager MSP versions prior to 126105 Zoho ManageEngine Network Configuration Manager versions prior to 126120 Zoho ManageEngine NetFlow Analyzer versions prior to 126120 Zoho ManageEngine OpUtils versions prior to 126120
Description The issue allows authenticated users to make database changes that lead to remote code execution in the NMAP feature. This is due to a command injection vulnerability in the getNmapInitialOption function.
Recommendations For Zoho ManageEngine OpManager version prior to 125658, update to version 125658 or later. For Zoho ManageEngine OpManager Plus version prior to 126003, update to version 126003 or later. For Zoho ManageEngine OpManager MSP version prior to 126105, update to version 126105 or later. For Zoho ManageEngine Network Configuration Manager version prior to 126120, update to version 126120 or later. For Zoho ManageEngine NetFlow Analyzer version prior to 126120, update to version 126120 or later. For Zoho ManageEngine OpUtils version prior to 126120, update to version 126120 or later. As a temporary workaround, consider disabling the getNmapInitialOption function until a patch is available.

Fix

Related Identifiers

CVE-2022-38772
ZDI-22-1180
ZDI-22-1181
ZDI-22-1182

Affected Products

Zoho Manageengine Netflow Analyzer
Zoho Manageengine Network Configuration Manager
Zoho Manageengine Opmanager
Zoho Manageengine Admanager Plus
Zoho Manageengine Oputils