PT-2022-6692 · Zoho · Zoho Manageengine Access Manager Plus+2

Published 2022-12-28 · Updated 2023-01-11 · CVE-2022-47523

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Access Manager Plus versions prior to 4309 Zoho ManageEngine Password Manager Pro versions prior to 12210 Zoho ManageEngine PAM360 versions prior to 5801

Description The issue is related to insufficient protection of the SQL query structure, allowing a remote attacker to execute arbitrary user queries or gain unauthorized access to protected information. Successful exploitation provides authenticated attackers with access to the server-side database, enabling them to execute custom queries to access database table records.

Recommendations For Zoho ManageEngine Access Manager Plus versions prior to 4309, update to version 4309 or later. For Zoho ManageEngine Password Manager Pro versions prior to 12210, update to version 12210 or later. For Zoho ManageEngine PAM360 versions prior to 5801, update to version 5801 or later. As a precaution, create backups of your installations before updating to prevent data loss.

Fix

XSS

SQL injection

Weakness Enumeration

CWE-79

CWE-89

Related Identifiers

BDU:2023-03420

CVE-2022-47523

Affected Products

Zoho Manageengine Access Manager Plus

Zoho Manageengine Pam360

Manageengine Password Manager Pro

References · 9

• https://manageengine.com/privileged-session-management/advisory/cve-2022-47523.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-47523 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03420 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-47523 · Security Note
• https://t.me/canyoupwnme/6842 · Telegram Post
• https://t.me/cvenotify/41286 · Telegram Post
• https://t.me/sysadm_in_channel/4373 · Telegram Post
• https://t.me/true_secator/3909 · Telegram Post
• https://vuldb.com/ru/?id.217478 · Note