PT-2022-6328 · Zoho · Zoho Manageengine Admanager Plus+4

Published 2022-07-29 · Updated 2022-09-05 · CVE-2022-37024

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine OpManager versions prior to 2022-07-29 Zoho ManageEngine OpManager Plus versions prior to 2022-07-29 Zoho ManageEngine OpManager MSP versions prior to 2022-07-29 Zoho ManageEngine Network Configuration Manager versions prior to 2022-07-29 Zoho ManageEngine NetFlow Analyzer versions prior to 2022-07-29 Zoho ManageEngine OpUtils versions prior to 2022-07-29

Description The issue is related to insufficient input validation when handling packets, which can be exploited by a remote attacker to execute arbitrary code. Authenticated users can make database changes that lead to remote code execution. The vulnerability is associated with the getDNSResolveOption command injection.

Recommendations For Zoho ManageEngine OpManager versions prior to 2022-07-29, update to a version released after 2022-07-29. For Zoho ManageEngine OpManager Plus versions prior to 2022-07-29, update to a version released after 2022-07-29. For Zoho ManageEngine OpManager MSP versions prior to 2022-07-29, update to a version released after 2022-07-29. For Zoho ManageEngine Network Configuration Manager versions prior to 2022-07-29, update to a version released after 2022-07-29. For Zoho ManageEngine NetFlow Analyzer versions prior to 2022-07-29, update to a version released after 2022-07-29. For Zoho ManageEngine OpUtils versions prior to 2022-07-29, update to a version released after 2022-07-29. As a temporary workaround, consider disabling the getDNSResolveOption command until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-00932

CVE-2022-37024

ZDI-22-1179

ZDI-22-1183

ZDI-22-1184

Affected Products

Zoho Manageengine Netflow Analyzer

Zoho Manageengine Network Configuration Manager

Zoho Manageengine Opmanager

Zoho Manageengine Admanager Plus

Zoho Manageengine Oputils

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-37024 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37024 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00932 · Security Note
• https://manageengine.com/itom/advisory/cve-2022-37024.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-1179 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1184 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-1183 · Security Note
• https://t.me/cibsecurity/47915 · Telegram Post