PT-2022-26999 · Zoho · Zoho Manageengine Access Manager Plus+2

Published 2022-11-12 · Updated 2022-11-17 · CVE-2022-43672

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Password Manager Pro versions prior to 12122 Zoho ManageEngine PAM360 versions prior to 5711 Zoho ManageEngine Access Manager Plus versions prior to 4306

Description The issue allows SQL Injection in a different software component.

Recommendations For Zoho ManageEngine Password Manager Pro versions prior to 12122, update to version 12122 or later. For Zoho ManageEngine PAM360 versions prior to 5711, update to version 5711 or later. For Zoho ManageEngine Access Manager Plus versions prior to 4306, update to version 4306 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-43672

Affected Products

Zoho Manageengine Access Manager Plus

Zoho Manageengine Pam360

Manageengine Password Manager Pro

References · 5

• https://osv.dev/vulnerability/CVE-2022-43672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43672 · Security Note
• https://manageengine.com/products/passwordmanagerpro/advisory/cve-2022-43672.html · Vendor Advisory
• https://t.me/cvenotify/37916 · Telegram Post
• https://t.me/cvenotify/37566 · Telegram Post