PT-2022-4859 · Zoho · Zoho Manageengine Access Manager Plus+2

Vinicius · Published 2022-07-19 · Updated 2025-10-31 · CVE-2022-35405

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Password Manager Pro versions prior to 12101 Zoho ManageEngine PAM360 versions prior to 5510 Zoho ManageEngine Access Manager Plus versions prior to 4303

Description The issue is related to a deserialization mechanism flaw in the xmlrpc component of Zoho ManageEngine Password Manager Pro and Zoho ManageEngine Access Manager Plus, allowing an unauthenticated remote attacker to execute arbitrary code.

Recommendations For Zoho ManageEngine Password Manager Pro versions prior to 12101, update to version 12101 or later. For Zoho ManageEngine PAM360 versions prior to 5510, update to version 5510 or later. For Zoho ManageEngine Access Manager Plus versions prior to 4303, update to version 4303 or later. As a temporary workaround, consider restricting access to the xmlrpc component until a patch is applied.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2022-05983

CVE-2022-35405

Affected Products

Zoho Manageengine Access Manager Plus

Zoho Manageengine Pam360

Manageengine Password Manager Pro

References · 19

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/zoho_password_manager_pro_xml_rpc_rce.rb · Exploit
• 🔥 https://github.com/viniciuspereiras/CVE-2022-35405 · Exploit
• 🔥 http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-35405 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35405 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05983 · Security Note
• https://t.me/true_secator/3463 · Telegram Post
• https://t.me/cybersecuritytechnologies/6516 · Telegram Post
• https://t.me/proxy_bar/1036 · Telegram Post
• https://twitter.com/fletch_ai/status/1699892061808312706 · Twitter Post
• https://manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html · Vendor Advisory, Security Note
• https://t.me/cvenotify/37126 · Telegram Post
• https://t.me/cibsecurity/46547 · Telegram Post
• https://t.me/cveNotify/141120 · Telegram Post
• https://t.me/cvenotify/33402 · Telegram Post