Vulnerability · Published Nov 12, 2022 · Assigned by mitre
CVE-2022-43671
Critical 9.8
In plain English
A critical-severity SQL injection in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 74.8% (higher than 99.5% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)74.8%top 0.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H