Vulnerability · Published Aug 10, 2022 · Assigned by mitre

CVE-2022-36923

Medium 5.4

In plain English

A medium-severity improper access control in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.7% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)7.7%top 5.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://www.manageengine.com/itom/advisory/cve-2022-36923.html x_refsource_MISC