Actively exploited · Published Jul 19, 2022 · Assigned by mitre

CVE-2022-35405

Critical 9.8 Exploited

In plain English

A critical-severity unsafe deserialization in ManageEngine from Zoho. Attackers are actively exploiting it in the wild (listed by CISA on September 22, 2022). The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)99.9%top 0.0% of all CVEs

Exploited in the wildYesCISA KEV since Sep 22, 2022

Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Oct 13, 2022.

Official description

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html x_refsource_MISC
http://packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-35405 government-resource