CVE-2022-47966: ManageEngine Endpoint...

On this page

CVE Details

Protection status: Protected by Atomicorp rules · About protection statuses
CVE: CVE-2022-47966
Name: ManageEngine Endpoint Central Unauthenticated SAML RCE
Severity: Critical
CVSS: 9.8 (v3.1) (Critical)
CVSS version: 3.1
CVSS source: N/A
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Confidentiality impact: High
- Integrity impact: High
- Availability impact: High
CWE: CWE-20 — Improper Input Validation
Related CAPEC attack patterns (via MITRE CWE relationships): CAPEC-10 (opens in a new tab) , CAPEC-101 (opens in a new tab) , CAPEC-104 (opens in a new tab) , CAPEC-108 (opens in a new tab) , CAPEC-109 (opens in a new tab) , CAPEC-110 (opens in a new tab) , CAPEC-120 (opens in a new tab) , CAPEC-13 (opens in a new tab) , CAPEC-135 (opens in a new tab) , CAPEC-136 (opens in a new tab) , CAPEC-14 (opens in a new tab) , CAPEC-153 (opens in a new tab) , CAPEC-182 (opens in a new tab) , CAPEC-209 (opens in a new tab) , CAPEC-22 (opens in a new tab) , CAPEC-23 (opens in a new tab) , CAPEC-230 (opens in a new tab) , CAPEC-231 (opens in a new tab) , CAPEC-24 (opens in a new tab) , CAPEC-250 (opens in a new tab) , CAPEC-261 (opens in a new tab) , CAPEC-267 (opens in a new tab) , CAPEC-28 (opens in a new tab) , CAPEC-3 (opens in a new tab) , CAPEC-31 (opens in a new tab) , CAPEC-42 (opens in a new tab) , CAPEC-43 (opens in a new tab) , CAPEC-45 (opens in a new tab) , CAPEC-46 (opens in a new tab) , CAPEC-47 (opens in a new tab) , CAPEC-473 (opens in a new tab) , CAPEC-52 (opens in a new tab) , CAPEC-53 (opens in a new tab) , CAPEC-588 (opens in a new tab) , CAPEC-63 (opens in a new tab) , CAPEC-64 (opens in a new tab) , CAPEC-664 (opens in a new tab) , CAPEC-67 (opens in a new tab) , CAPEC-7 (opens in a new tab) , CAPEC-71 (opens in a new tab) , CAPEC-72 (opens in a new tab) , CAPEC-73 (opens in a new tab) , CAPEC-78 (opens in a new tab) , CAPEC-79 (opens in a new tab) , CAPEC-8 (opens in a new tab) , CAPEC-80 (opens in a new tab) , CAPEC-81 (opens in a new tab) , CAPEC-83 (opens in a new tab) , CAPEC-85 (opens in a new tab) , CAPEC-88 (opens in a new tab) , CAPEC-9 (opens in a new tab)
Vendor: zohocorp
Vulnerable products: manageengine access manager plus , manageengine ad360 , manageengine adaudit plus , manageengine admanager plus , manageengine adselfservice plus , manageengine analytics plus , manageengine assetexplorer , manageengine key manager plus , manageengine pam360 , manageengine password manager pro , manageengine servicedesk plus , manageengine servicedesk plus msp , manageengine supportcenter plus , manageengine application control plus , manageengine browser security plus , manageengine device control plus , manageengine endpoint dlp plus , manageengine os deployer , manageengine patch manager plus , manageengine remote access plus , manageengine remote monitoring and management central , manageengine vulnerability manager plus
CVE published: 2023-01-18
CVE last modified: 2026-06-17
Affected versions (NVD configurations):
- manageengine access manager plus: < 4.3
- manageengine access manager plus: 4.3 build4300
- manageengine access manager plus: 4.3 build4301
- manageengine access manager plus: 4.3 build4302
- manageengine access manager plus: 4.3 build4303
- manageengine access manager plus: 4.3 build4304
- manageengine access manager plus: 4.3 build4305
- manageengine access manager plus: 4.3 build4306
- manageengine access manager plus: 4.3 build4307
- manageengine ad360: < 4.3
- manageengine ad360: 4.3 4300
- manageengine ad360: 4.3 4302
- manageengine ad360: 4.3 4303
- manageengine ad360: 4.3 4304
- manageengine ad360: 4.3 4305
- manageengine ad360: 4.3 4306
- manageengine ad360: 4.3 4308
- manageengine ad360: 4.3 4309
- manageengine adaudit plus: < 7.0
- manageengine adaudit plus: 7.0 7000
- manageengine adaudit plus: 7.0 7002
- manageengine adaudit plus: 7.0 7003
- manageengine adaudit plus: 7.0 7004
- manageengine adaudit plus: 7.0 7005
- manageengine adaudit plus: 7.0 7006
- manageengine adaudit plus: 7.0 7007
- manageengine adaudit plus: 7.0 7008
- manageengine adaudit plus: 7.0 7050
- manageengine adaudit plus: 7.0 7051
- manageengine adaudit plus: 7.0 7052
- manageengine adaudit plus: 7.0 7053
- manageengine adaudit plus: 7.0 7054
- manageengine adaudit plus: 7.0 7055
- manageengine adaudit plus: 7.0 7060
- manageengine adaudit plus: 7.0 7062
- manageengine adaudit plus: 7.0 7063
- manageengine adaudit plus: 7.0 7065
- manageengine adaudit plus: 7.0 7080
- manageengine admanager plus: < 7.1
- manageengine admanager plus: 7.1 7100
- manageengine admanager plus: 7.1 7101
- manageengine admanager plus: 7.1 7102
- manageengine admanager plus: 7.1 7110
- manageengine admanager plus: 7.1 7111
- manageengine admanager plus: 7.1 7112
- manageengine admanager plus: 7.1 7113
- manageengine admanager plus: 7.1 7114
- manageengine admanager plus: 7.1 7115
- manageengine admanager plus: 7.1 7116
- manageengine admanager plus: 7.1 7117
- manageengine admanager plus: 7.1 7118
- manageengine admanager plus: 7.1 7120
- manageengine admanager plus: 7.1 7121
- manageengine admanager plus: 7.1 7122
- manageengine admanager plus: 7.1 7123
- manageengine admanager plus: 7.1 7124
- manageengine admanager plus: 7.1 7125
- manageengine admanager plus: 7.1 7126
- manageengine admanager plus: 7.1 7130
- manageengine admanager plus: 7.1 7131
- manageengine admanager plus: 7.1 7140
- manageengine admanager plus: 7.1 7141
- manageengine admanager plus: 7.1 7150
- manageengine admanager plus: 7.1 7151
- manageengine admanager plus: 7.1 7160
- manageengine admanager plus: 7.1 7161
- manageengine adselfservice plus: < 6.2
- manageengine adselfservice plus: 6.2 6200
- manageengine adselfservice plus: 6.2 6201
- manageengine adselfservice plus: 6.2 6202
- manageengine adselfservice plus: 6.2 6203
- manageengine adselfservice plus: 6.2 6204
- manageengine adselfservice plus: 6.2 6205
- manageengine adselfservice plus: 6.2 6206
- manageengine adselfservice plus: 6.2 6207
- manageengine adselfservice plus: 6.2 6208
- manageengine adselfservice plus: 6.2 6209
- manageengine adselfservice plus: 6.2 6210
- manageengine analytics plus: < 5.1
- manageengine analytics plus: 5.1 5100
- manageengine analytics plus: 5.1 5110
- manageengine analytics plus: 5.1 5120
- manageengine analytics plus: 5.1 5121
- manageengine analytics plus: 5.1 5130
- manageengine analytics plus: 5.1 5140
- manageengine assetexplorer: < 6.9
- manageengine assetexplorer: 6.9 6900
- manageengine assetexplorer: 6.9 6901
- manageengine assetexplorer: 6.9 6902
- manageengine assetexplorer: 6.9 6903
- manageengine assetexplorer: 6.9 6904
- manageengine assetexplorer: 6.9 6905
- manageengine assetexplorer: 6.9 6906
- manageengine assetexplorer: 6.9 6907
- manageengine assetexplorer: 6.9 6908
- manageengine assetexplorer: 6.9 6909
- manageengine assetexplorer: 6.9 6950
- manageengine assetexplorer: 6.9 6951
- manageengine assetexplorer: 6.9 6952
- manageengine assetexplorer: 6.9 6953
- manageengine assetexplorer: 6.9 6954
- manageengine assetexplorer: 6.9 6955
- manageengine assetexplorer: 6.9 6956
- manageengine assetexplorer: 6.9 6957
- manageengine assetexplorer: 6.9 6970
- manageengine assetexplorer: 6.9 6971
- manageengine assetexplorer: 6.9 6972
- manageengine assetexplorer: 6.9 6973
- manageengine assetexplorer: 6.9 6974
- manageengine assetexplorer: 6.9 6975
- manageengine assetexplorer: 6.9 6976
- manageengine assetexplorer: 6.9 6977
- manageengine assetexplorer: 6.9 6978
- manageengine assetexplorer: 6.9 6979
- manageengine assetexplorer: 6.9 6980
- manageengine assetexplorer: 6.9 6981
- manageengine assetexplorer: 6.9 6982
- manageengine key manager plus: < 6.4
- manageengine key manager plus: 6.4 6400
- manageengine pam360: < 5.7
- manageengine pam360: 5.7 build5700
- manageengine pam360: 5.7 build5710
- manageengine pam360: 5.7 build5711
- manageengine pam360: 5.7 build5712
- manageengine password manager pro: < 12.1
- manageengine password manager pro: 12.1 build12100
- manageengine password manager pro: 12.1 build12101
- manageengine password manager pro: 12.1 build12110
- manageengine password manager pro: 12.1 build12120
- manageengine password manager pro: 12.1 build12121
- manageengine password manager pro: 12.1 build12122
- manageengine password manager pro: 12.1 build12123
- manageengine servicedesk plus: < 14.0
- manageengine servicedesk plus: 14.0 14000
- manageengine servicedesk plus: 14.0 14001
- manageengine servicedesk plus: 14.0 14002
- manageengine servicedesk plus: 14.0 14003
- manageengine servicedesk plus msp: < 13.0
- manageengine servicedesk plus msp: 13.0 13000
- manageengine supportcenter plus: 11.0 11017
- manageengine supportcenter plus: 11.0 11018
- manageengine supportcenter plus: 11.0 11019
- manageengine supportcenter plus: 11.0 11020
- manageengine supportcenter plus: 11.0 11021
- manageengine supportcenter plus: 11.0 11022
- manageengine supportcenter plus: 11.0 11024
- manageengine supportcenter plus: 11.0 11025
- manageengine application control plus: < 10.1.2220.18
- manageengine browser security plus: < 11.1.2238.6
- manageengine device control plus: < 10.1.2220.18
- manageengine endpoint dlp plus: < 10.1.2137.6
- manageengine os deployer: < 1.1.2243.1
- manageengine patch manager plus: < 10.1.2220.18
- manageengine remote access plus: < 10.1.2228.11
- manageengine remote monitoring and management central: < 10.1.41
- manageengine vulnerability manager plus: < 10.1.2220.18
EPSS: 0.9975; 100.0th percentile as of 2026-10-21 (FIRST (opens in a new tab) )
CISA KEV: Listed (added 2023-01-23)
- Known ransomware campaign use: Known
Latest Update: 2026-10-21
Selected Rule IDs observed: 341256 , 344370 , 350147 , 383023
Matching rules: 4; rules with blocking actions: 4
Would-block Rule IDs: 341256 , 344370 , 350147 , 383023
Request surfaces inspected: JSON request data, Request URI, Request argument names, Request arguments, Request body, Request cookies, SOAP request data, XML request data

Technical vulnerability details · CVSS assessments, exploit evidence & CPE data

CVSS assessments

CVSS v3.1 · NVD

Base score: 9.8
Base severity: CRITICAL
Exploitability subscore: 3.9
Impact subscore: 5.9
Assessment type: Primary
Source identifier: nvd@nist.gov
Full vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Confidentiality impact: High
- Integrity impact: High
- Availability impact: High
Exploit maturity: Not scored

CVSS v3.1 · CISA ADP

Base score: 9.8
Base severity: CRITICAL
Exploitability subscore: 3.9
Impact subscore: 5.9
Assessment type: Secondary
Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Full vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Confidentiality impact: High
- Integrity impact: High
- Availability impact: High
Exploit maturity: Not scored

Exploitability and impact subscores describe the vulnerability’s technical characteristics. Exploit maturity describes the reported state of exploitation; these are separate measures.

Assessment source: NVD record (opens in a new tab) · CVE record (opens in a new tab)

CISA SSVC assessments

These are CISA’s published decision points at the assessment time. They are not a complete organization-specific prioritization decision.

Provider: CISA ADP
Provider identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0
SSVC version: 2.0.3
Role: CISA Coordinator
Assessment timestamp: 2023-12-22T05:00:59.744032Z
Exploitation: active
Automatable: yes
Technical Impact: total
Source: CISA ADP in the CVE record (opens in a new tab)

Exploit references

The CVE source data tags these references as exploits. A reference alone does not establish reliability or active exploitation.

Vulnerable CPE configurations

cpe:2.3:a:zohocorp:manageengine_access_manager_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 4.3
- NVD match criteria ID: 5FDF15FF-2561-4139-AC5E-4812584B1B03
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:*
- NVD match criteria ID: D5DEC045-6A7E-4041-88F8-5ABC4AB51C29
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:*
- NVD match criteria ID: 52DDE5D9-28DE-446F-A402-7BE3C33A4B35
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:*
- NVD match criteria ID: F6E1E4D8-B7F0-4BDB-B5A2-55436BEC85F1
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4303:*:*:*:*:*:*
- NVD match criteria ID: 59675CC4-8A5C-4668-908C-0886B4B310DC
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4304:*:*:*:*:*:*
- NVD match criteria ID: 45084336-F1DC-4E5B-A45E-506A779985D9
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4305:*:*:*:*:*:*
- NVD match criteria ID: 1B2CC071-5BB3-4A25-88F2-DBC56B94D895
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4306:*:*:*:*:*:*
- NVD match criteria ID: E6FDF373-4711-4B72-A14E-CEB19301C40F
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4307:*:*:*:*:*:*
- NVD match criteria ID: 0E0F346C-0445-4D38-8583-3379962B540F
cpe:2.3:a:zohocorp:manageengine_ad360:*:*:*:*:*:*:*:*
- Version end (exclusive): 4.3
- NVD match criteria ID: D2B1FA6A-43DB-4CCC-AC05-77810ED7B80D
cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4300:*:*:*:*:*:*
- NVD match criteria ID: 1179FC2E-0FCC-4744-85A7-1D68AE742FEE
cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4302:*:*:*:*:*:*
- NVD match criteria ID: F05F8E9D-1880-4B94-922E-BA61FA112945
cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4303:*:*:*:*:*:*
- NVD match criteria ID: F336B0C2-1F99-4BC7-828B-02E432CB0723
cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4304:*:*:*:*:*:*
- NVD match criteria ID: CBBA787F-7F38-4AD3-90BE-D307D75F1BCA
cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4305:*:*:*:*:*:*
- NVD match criteria ID: 46A96B82-49E1-4392-BDCF-CC9753D67A4E
cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4306:*:*:*:*:*:*
- NVD match criteria ID: 837BF464-6D18-4267-8913-D7937C91789B
cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4308:*:*:*:*:*:*
- NVD match criteria ID: 0243CA85-B856-4ED9-BCD0-5EAB182862CD
cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4309:*:*:*:*:*:*
- NVD match criteria ID: FB216CD0-B3BD-434D-8FC6-BB60408C128A
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 7.0
- NVD match criteria ID: FFA4EA7A-B1C1-4750-A11D-89054B77B320
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7000:*:*:*:*:*:*
- NVD match criteria ID: 16BADE82-3652-4074-BDFF-828B7213CAF6
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7002:*:*:*:*:*:*
- NVD match criteria ID: 01E9CAE9-4B45-4E7A-BE78-6E7E9A3A04E8
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7003:*:*:*:*:*:*
- NVD match criteria ID: CFA4FC59-CC4F-4F21-9AE9-3F526C91411C
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7004:*:*:*:*:*:*
- NVD match criteria ID: 26A6F6D1-540C-43C5-96A7-0E36F3E0A4D7
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7005:*:*:*:*:*:*
- NVD match criteria ID: 97EA9324-9377-46E1-A0EA-637128E65DED
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7006:*:*:*:*:*:*
- NVD match criteria ID: EA5BE36E-A73A-4D1C-8185-9692373F1444
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7007:*:*:*:*:*:*
- NVD match criteria ID: 10F48951-44A1-42C1-AE2A-B2CDFFCAFDBF
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7008:*:*:*:*:*:*
- NVD match criteria ID: F505C783-09DE-4045-9DB4-DD850B449A48
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7050:*:*:*:*:*:*
- NVD match criteria ID: 212BF664-02DE-457F-91A6-6F824ECC963B
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7051:*:*:*:*:*:*
- NVD match criteria ID: D102B74F-6762-4EFE-BAF7-A7D416867D9D
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7052:*:*:*:*:*:*
- NVD match criteria ID: FEDF5C01-41D8-45C0-8F0D-3A7FCB6DADEE
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7053:*:*:*:*:*:*
- NVD match criteria ID: 5D6ACBF5-25C6-403A-BCFA-66A90A8B4E14
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7054:*:*:*:*:*:*
- NVD match criteria ID: CF50DCAC-33E1-4FE2-BF3C-C6A17CC8E48A
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7055:*:*:*:*:*:*
- NVD match criteria ID: 5B2F6EE4-F3DC-43CE-B7FD-C9522A35406A
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7060:*:*:*:*:*:*
- NVD match criteria ID: 623151CB-4C6B-4068-B173-FE8E73D652F5
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7062:*:*:*:*:*:*
- NVD match criteria ID: 1D84377E-CB44-4C6A-A665-763A1CD1AF34
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7063:*:*:*:*:*:*
- NVD match criteria ID: 603D1875-BD5E-4C6C-9D2C-3CAA9D7B3AE0
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7065:*:*:*:*:*:*
- NVD match criteria ID: 4C568190-1C1B-44FA-B50A-C142A0B8224D
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7080:*:*:*:*:*:*
- NVD match criteria ID: F876B2E2-C2FF-47BE-9F53-5F86606A08CA
cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 7.1
- NVD match criteria ID: B9D72627-17F9-427E-907B-56EA0A498131
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7100:*:*:*:*:*:*
- NVD match criteria ID: 736740CB-A328-4163-BAC4-6C881A24C8B1
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7101:*:*:*:*:*:*
- NVD match criteria ID: 9B806083-7309-4215-AF81-DCC4D90B7876
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7102:*:*:*:*:*:*
- NVD match criteria ID: A741CDA8-D1A8-4F83-AE54-7D3D3C433825
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7110:*:*:*:*:*:*
- NVD match criteria ID: 09563D6F-690B-4C7A-BA25-52D009724A74
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7111:*:*:*:*:*:*
- NVD match criteria ID: 30FAC23B-831E-4904-AB3B-85A3C068CEB8
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7112:*:*:*:*:*:*
- NVD match criteria ID: 9347D3CF-B5D1-4ACE-83E1-73748EF15120
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7113:*:*:*:*:*:*
- NVD match criteria ID: 322E0562-4586-4DF4-A935-C2447883495B
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7114:*:*:*:*:*:*
- NVD match criteria ID: EB9151D6-BD21-4268-9371-FF702C1AD84B
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7115:*:*:*:*:*:*
- NVD match criteria ID: B371E93E-7C85-42DD-AA7F-9B43D8D02963
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7116:*:*:*:*:*:*
- NVD match criteria ID: 094EEFA4-BD16-4F79-8133-62F9E2C8C675
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7117:*:*:*:*:*:*
- NVD match criteria ID: DC5A6297-98E3-45C8-95FB-7F4E65D133BF
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7118:*:*:*:*:*:*
- NVD match criteria ID: 93C96678-34B7-4FCE-9DBD-1A7B3E0943BB
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7120:*:*:*:*:*:*
- NVD match criteria ID: 9E9B9E88-919F-4CF7-99DC-72E50BDF65A9
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7121:*:*:*:*:*:*
- NVD match criteria ID: 7848B31C-AB51-486B-8655-7D7A060BAFFC
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7122:*:*:*:*:*:*
- NVD match criteria ID: 1CFB5C4A-B717-4CC2-AE03-336C63D17B96
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7123:*:*:*:*:*:*
- NVD match criteria ID: 456D49D7-F04D-4003-B429-8D5504959D04
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7124:*:*:*:*:*:*
- NVD match criteria ID: BB788440-904B-430E-BF5B-12ADA816477E
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7125:*:*:*:*:*:*
- NVD match criteria ID: 876CC4D6-9546-4D39-965A-EF5A4AF4AD93
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7126:*:*:*:*:*:*
- NVD match criteria ID: 85432FE8-946F-448D-A92A-FF549EDC52F8
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7130:*:*:*:*:*:*
- NVD match criteria ID: 813E1389-A949-427C-92C6-3974702FEA5D
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7131:*:*:*:*:*:*
- NVD match criteria ID: 34A48841-EA09-4917-A6FF-DF645B581426
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7140:*:*:*:*:*:*
- NVD match criteria ID: 1C042646-9D36-4712-9E5D-40E55FCF7C24
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7141:*:*:*:*:*:*
- NVD match criteria ID: 9E6CD67A-7F5A-4F29-B563-7E4D72A1149F
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7150:*:*:*:*:*:*
- NVD match criteria ID: 77A0C792-A8B7-48F8-9AD7-96B0CBAD4EBF
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7151:*:*:*:*:*:*
- NVD match criteria ID: 7E53B3CB-4351-4E24-B80C-D62CC483D4D7
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7160:*:*:*:*:*:*
- NVD match criteria ID: 0068E901-62D2-4C4D-96F8-7823B0DF7DA8
cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7161:*:*:*:*:*:*
- NVD match criteria ID: CF70BA56-3478-4DA5-B013-4D9B820D2219
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 6.2
- NVD match criteria ID: 7BC9667B-3ECE-4DF8-9C45-95E53736CD68
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6200:*:*:*:*:*:*
- NVD match criteria ID: BAFCD8BD-07E4-4AD3-B802-9A6D2254777A
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6201:*:*:*:*:*:*
- NVD match criteria ID: B1E4E7ED-317B-471D-B387-24BFE504FD48
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6202:*:*:*:*:*:*
- NVD match criteria ID: 1518C214-71A7-4C97-BA40-95D98E0C78BB
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6203:*:*:*:*:*:*
- NVD match criteria ID: 247ED04D-E067-4A18-8514-9CD635DF4F09
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6204:*:*:*:*:*:*
- NVD match criteria ID: 8AC2C862-7709-44BF-9D0C-1BD63B381001
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6205:*:*:*:*:*:*
- NVD match criteria ID: 1E936706-E1D6-496A-8395-96706AF32F19
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6206:*:*:*:*:*:*
- NVD match criteria ID: CA25E9BB-DDB9-438C-890A-61264C10BFF0
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6207:*:*:*:*:*:*
- NVD match criteria ID: D71FF123-F797-4E0D-8167-DD4563733879
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6208:*:*:*:*:*:*
- NVD match criteria ID: 1156F671-D6BD-4FA2-924F-1802F157A025
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6209:*:*:*:*:*:*
- NVD match criteria ID: C7ABB8B4-1CBF-4437-A751-B51F2B061C7D
cpe:2.3:a:zohocorp:manageengine_adselfservice_plus:6.2:6210:*:*:*:*:*:*
- NVD match criteria ID: E870D833-28A7-45E1-9A6B-26A33D66B507
cpe:2.3:a:zohocorp:manageengine_analytics_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 5.1
- NVD match criteria ID: 2026DE5E-EDDA-4134-A63E-1F01A9ED209F
cpe:2.3:a:zohocorp:manageengine_analytics_plus:5.1:5100:*:*:*:*:*:*
- NVD match criteria ID: DBEE7368-580D-422E-80DE-079462579BD4
cpe:2.3:a:zohocorp:manageengine_analytics_plus:5.1:5110:*:*:*:*:*:*
- NVD match criteria ID: 92C88B5F-3689-4314-B23E-D9051808C1D9
cpe:2.3:a:zohocorp:manageengine_analytics_plus:5.1:5120:*:*:*:*:*:*
- NVD match criteria ID: 839EB997-896A-4CD9-BADF-1C2DC2B498F0
cpe:2.3:a:zohocorp:manageengine_analytics_plus:5.1:5121:*:*:*:*:*:*
- NVD match criteria ID: 7A4DF40E-2941-4A38-9297-42502D7EE0C5
cpe:2.3:a:zohocorp:manageengine_analytics_plus:5.1:5130:*:*:*:*:*:*
- NVD match criteria ID: DD056927-1BC0-42A0-8E26-7FC0F4BE58AF
cpe:2.3:a:zohocorp:manageengine_analytics_plus:5.1:5140:*:*:*:*:*:*
- NVD match criteria ID: 99F6F9CC-5A94-4A74-8D36-BE198424C955
cpe:2.3:a:zohocorp:manageengine_assetexplorer:*:*:*:*:*:*:*:*
- Version end (exclusive): 6.9
- NVD match criteria ID: A6DEEF51-0977-4061-9919-803DFD144E10
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6900:*:*:*:*:*:*
- NVD match criteria ID: 7D0754D0-5B28-4851-89A2-DC5B20CFF3E8
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6901:*:*:*:*:*:*
- NVD match criteria ID: 6E0CAA5B-16A1-4637-B90A-BFAF7381CCD9
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6902:*:*:*:*:*:*
- NVD match criteria ID: 48A960D7-7AB2-43F4-99FC-5B1FE69BFDB6
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6903:*:*:*:*:*:*
- NVD match criteria ID: B293513C-9ECB-4512-B1B8-A470C6115458
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6904:*:*:*:*:*:*
- NVD match criteria ID: 5D9B89EB-C51F-4A70-A6DF-1BD326308DA5
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6905:*:*:*:*:*:*
- NVD match criteria ID: 9B708143-01B3-45D0-A769-E1D8E99237B5
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6906:*:*:*:*:*:*
- NVD match criteria ID: F1837C80-7D1F-4AF5-BF4B-932DF03D6A30
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6907:*:*:*:*:*:*
- NVD match criteria ID: 4E528B83-1539-4516-9ACF-A05E853014DF
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6908:*:*:*:*:*:*
- NVD match criteria ID: CBFB65BC-5B94-4075-BBB1-4CD8B5B216C3
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6909:*:*:*:*:*:*
- NVD match criteria ID: 7FAF3DFA-78FB-417C-808A-507F66889913
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6950:*:*:*:*:*:*
- NVD match criteria ID: E9506197-CDDA-451B-9FE3-72B3C3BA19EF
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6951:*:*:*:*:*:*
- NVD match criteria ID: 691DF8EC-6A7A-4449-8A4C-79F76726D685
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6952:*:*:*:*:*:*
- NVD match criteria ID: 0B3E2B0A-EB1E-45C3-BC2C-9E32268A0867
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6953:*:*:*:*:*:*
- NVD match criteria ID: E1BD2753-52B8-4EB0-8332-C67935FB8B47
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6954:*:*:*:*:*:*
- NVD match criteria ID: E8BD08BF-4E5D-4DE4-A499-B0296C126599
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6955:*:*:*:*:*:*
- NVD match criteria ID: F13CB227-496C-4777-BE76-27AFF5ED15C2
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6956:*:*:*:*:*:*
- NVD match criteria ID: 2AB1DF8F-3385-40C6-92C5-10724F8A6911
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6957:*:*:*:*:*:*
- NVD match criteria ID: C1997DE8-8CFA-4882-9107-741B88339A67
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6970:*:*:*:*:*:*
- NVD match criteria ID: 148F6458-136D-4612-9619-F51AEEC11AA6
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6971:*:*:*:*:*:*
- NVD match criteria ID: 8B189696-D6BC-475B-90CA-AF122224FEAA
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6972:*:*:*:*:*:*
- NVD match criteria ID: 477C97EC-A497-4C7C-973B-2C057A9242AD
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6973:*:*:*:*:*:*
- NVD match criteria ID: 284F5D9D-F23F-4936-B461-10701CC3AB7C
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6974:*:*:*:*:*:*
- NVD match criteria ID: 74CE0145-F165-4FB4-A819-01B30641196A
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6975:*:*:*:*:*:*
- NVD match criteria ID: CA291C44-616B-45D9-9709-61CD33E8B135
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6976:*:*:*:*:*:*
- NVD match criteria ID: C1C7492E-5D5B-419D-9749-7CC6EE5BC0FE
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6977:*:*:*:*:*:*
- NVD match criteria ID: DCF1B243-DA58-42CD-9DF4-6D4A010796D8
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6978:*:*:*:*:*:*
- NVD match criteria ID: 2B73FD0F-6B48-406E-AB29-606CC07C81C2
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6979:*:*:*:*:*:*
- NVD match criteria ID: CED2C49D-DB96-4495-BD6F-460871D94EDA
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6980:*:*:*:*:*:*
- NVD match criteria ID: C9AAC638-1379-4F87-9BA3-07CE16CAB98A
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6981:*:*:*:*:*:*
- NVD match criteria ID: B3470B5B-B8BC-41B9-8CA5-5E7A0EB9934F
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6982:*:*:*:*:*:*
- NVD match criteria ID: 3A2D9355-B1D5-4B14-8900-42E7C8DC5E4E
cpe:2.3:a:zohocorp:manageengine_key_manager_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 6.4
- NVD match criteria ID: BB1E5798-5079-4292-9C11-2F334F8AC825
cpe:2.3:a:zohocorp:manageengine_key_manager_plus:6.4:6400:*:*:*:*:*:*
- NVD match criteria ID: 37D11E5C-C569-4D9F-BFF8-315F6D458D68
cpe:2.3:a:zohocorp:manageengine_pam360:*:*:*:*:*:*:*:*
- Version end (exclusive): 5.7
- NVD match criteria ID: 1478BFC3-A0B2-415B-BA1C-AA09D9451C93
cpe:2.3:a:zohocorp:manageengine_pam360:5.7:build5700:*:*:*:*:*:*
- NVD match criteria ID: 1E270FB5-C447-4C93-9947-2CE50850A46B
cpe:2.3:a:zohocorp:manageengine_pam360:5.7:build5710:*:*:*:*:*:*
- NVD match criteria ID: 496AFB26-1E11-4632-8C10-CD80F601FCFE
cpe:2.3:a:zohocorp:manageengine_pam360:5.7:build5711:*:*:*:*:*:*
- NVD match criteria ID: B2CE86DA-B688-4E9E-AF16-1974858D18BF
cpe:2.3:a:zohocorp:manageengine_pam360:5.7:build5712:*:*:*:*:*:*
- NVD match criteria ID: 4BFA2F57-4506-4B3D-86E8-BE9BEC1134B4
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:*:*:*:*
- Version end (exclusive): 12.1
- NVD match criteria ID: 76C7DC97-8BF1-421F-9272-FD301D2D7A3F
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12100:*:*:*:*:*:*
- NVD match criteria ID: 9BE65B96-74ED-48F1-B86D-CB3387D989CB
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12101:*:*:*:*:*:*
- NVD match criteria ID: B4127640-1F60-4687-A24A-22B05A125290
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12110:*:*:*:*:*:*
- NVD match criteria ID: E42928FB-E0E7-4951-B9B1-CEF60560A945
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12120:*:*:*:*:*:*
- NVD match criteria ID: 43C059E6-E1CA-4792-B383-93062CD82D66
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12121:*:*:*:*:*:*
- NVD match criteria ID: 8D21A9EB-51BC-4EEA-BAA4-8C2096A9DDD5
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12122:*:*:*:*:*:*
- NVD match criteria ID: 6C34175B-0978-4207-BFC0-F38FDFF9B3D5
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12123:*:*:*:*:*:*
- NVD match criteria ID: 6CAB911E-5CE6-47BA-9909-C42BDFEE0F5E
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 14.0
- NVD match criteria ID: FB1A6B88-6EE0-41F2-9FB6-243DFB52F92A
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14000:*:*:*:*:*:*
- NVD match criteria ID: 23A6549A-A30E-4693-9BAB-2685DB8C40BC
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14001:*:*:*:*:*:*
- NVD match criteria ID: 71CED256-A0EF-4933-AE18-421E37D5DB16
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14002:*:*:*:*:*:*
- NVD match criteria ID: 2EEAFF47-78C6-4F48-BD89-CD2B02D420DC
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:14.0:14003:*:*:*:*:*:*
- NVD match criteria ID: E3E8FEC0-688A-4BA6-9B4A-C59AD7FDAF8F
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:*
- Version end (exclusive): 13.0
- NVD match criteria ID: 969E1FCF-76A0-40BC-A38F-56FCB713419F
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:13.0:13000:*:*:*:*:*:*
- NVD match criteria ID: 298E6401-A9A9-43B6-901F-327944E0AF94
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11017:*:*:*:*:*:*
- NVD match criteria ID: 35366F60-D6E2-4B29-B593-D24079CE6831
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11018:*:*:*:*:*:*
- NVD match criteria ID: CB60E016-82DD-41EC-85F9-D4F37AF1F8E3
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11019:*:*:*:*:*:*
- NVD match criteria ID: 9B83E37C-B1F6-4CEB-8A8E-39E24BE8B59C
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11020:*:*:*:*:*:*
- NVD match criteria ID: 80B62BA0-2CF1-4828-99A9-7DD13CFCB9BE
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11021:*:*:*:*:*:*
- NVD match criteria ID: 7F529DB6-4D30-49F8-BFE2-C10C1A899917
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11022:*:*:*:*:*:*
- NVD match criteria ID: 4EA25296-8163-4C98-A8CD-35834240308E
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11024:*:*:*:*:*:*
- NVD match criteria ID: 33D51403-A976-4EA3-AA23-C699E03239E2
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11025:*:*:*:*:*:*
- NVD match criteria ID: D86A2E8A-1689-4E6E-B50B-E16CBCEB0C23
cpe:2.3:a:zohocorp:manageengine_application_control_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 10.1.2220.18
- NVD match criteria ID: 470ACB71-9439-4CC9-B88B-B9AB5455EA9B
cpe:2.3:a:zohocorp:manageengine_browser_security_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 11.1.2238.6
- NVD match criteria ID: 98FAA4DE-2C24-4ED4-9F2C-84CEA3200E31
cpe:2.3:a:zohocorp:manageengine_device_control_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 10.1.2220.18
- NVD match criteria ID: 8239C2A0-BA6D-4B5C-B02F-617178685D52
cpe:2.3:a:zohocorp:manageengine_endpoint_dlp_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 10.1.2137.6
- NVD match criteria ID: 4CA4E3A8-CAB3-461E-8A99-F7D115B17E71
cpe:2.3:a:zohocorp:manageengine_os_deployer:*:*:*:*:*:*:*:*
- Version end (exclusive): 1.1.2243.1
- NVD match criteria ID: 53EC71FA-E248-4DA5-BA76-746631AC435E
cpe:2.3:a:zohocorp:manageengine_patch_manager_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 10.1.2220.18
- NVD match criteria ID: 5784980D-CEBB-4982-BD1F-FD8F5F2A039C
cpe:2.3:a:zohocorp:manageengine_remote_access_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 10.1.2228.11
- NVD match criteria ID: 06A9F459-2C86-4646-B87C-A55381E0939F
cpe:2.3:a:zohocorp:manageengine_remote_monitoring_and_management_central:*:*:*:*:*:*:*:*
- Version end (exclusive): 10.1.41
- NVD match criteria ID: 5D851B9A-EE8F-4634-A26D-BCC44B5CF02A
cpe:2.3:a:zohocorp:manageengine_vulnerability_manager_plus:*:*:*:*:*:*:*:*
- Version end (exclusive): 10.1.2220.18
- NVD match criteria ID: 450E672F-FA36-4770-87B6-CC8DA66D2222

Vulnerability Description

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Recommended Actions

Maintain the observed Atomicorp protections. Keep your Atomicorp commercial rules current and confirm that the selected observed rules (341256 , 344370 , 350147 , 383023 ) have not been locally disabled. Atomicorp commercial rules are enabled by default. If you use Atomic WAF, review the applicable policy and rule settings.
Apply the vendor’s remediation. WAF protection is defense in depth and does not replace upgrading or following the affected vendor’s guidance.
- The CVE record does not include written upgrade or workaround instructions, but it does publish the following patch or mitigation reference:
  - Patch or mitigation information (opens in a new tab)
  - Patch or mitigation information (opens in a new tab)
- CISA KEV required action: Apply updates per vendor instructions.
- CISA KEV federal remediation due date: 2023-02-13
Validate after changes. Confirm rule updates are current, review WAF events for the affected application, and test application behavior after vendor upgrades, mitigations, or local policy changes.

Research Notes

Atomicorp WAF protections are designed around attack techniques and exploit behaviors, allowing existing protections to apply across multiple vulnerabilities without requiring a unique rule for every CVE.

Public Vulnerability References

NVD (opens in a new tab)
CVE Record (opens in a new tab)
Exploit or technical research: http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html (opens in a new tab)
Exploit or technical research: http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html (opens in a new tab)
Exploit or technical research: http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html (opens in a new tab)
Exploit or technical research: https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis (opens in a new tab)
Exploit or technical research: https://blog.viettelcybersecurity.com/saml-show-stopper/ (opens in a new tab)
Patch or mitigation: https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6 (opens in a new tab)
Exploit or technical research: https://github.com/horizon3ai/CVE-2022-47966 (opens in a new tab)
Exploit or technical research: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a (opens in a new tab)
Exploit or technical research: https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/ (opens in a new tab)
Vendor advisory: https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html (opens in a new tab)
CVE authority reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-47966 (opens in a new tab)

MITRE ATT&CK Context

The following mappings are published by the MITRE Center for Threat-Informed Defense and describe exploitation behavior or potential impact; they do not claim that a WAF rule implements the ATT&CK technique.

Primary Impact: T1136.001 — Local Account (opens in a new tab)
Primary Impact: T1068 — Exploitation for Privilege Escalation (opens in a new tab)
Exploitation Technique: T1190 — Exploit Public-Facing Application (opens in a new tab)

Test or Research Source

Source: Metasploit exploit/windows/http/manageengine_endpoint_central_saml_rce_cve_2022_47966 (opens in a new tab)
Tags: CVE-2022-47966, cve, http, metasploit, replay

Research Note Context

This research note documents exploit-technique analysis associated with this vulnerability and references Atomicorp WAF protections observed during engineering review, testing, or validation activities.

Atomicorp security controls are generally designed to identify and mitigate attack techniques and exploit behaviors rather than individual CVE identifiers. As a result, protections developed for one vulnerability may also apply to related attack variants and future vulnerabilities using similar techniques.

Learn More

Atomicorp develops commercially supported security technologies for web applications, servers, endpoints, workloads, and legacy enterprise platforms.

Organizations interested in protecting systems against exploit techniques associated with vulnerabilities such as this one can learn more about:

Atomic ModSecurity Rules: commercially maintained WAF rules for ModSecurity deployments, including protections for web attacks, bots, scanners, malware, exploitation attempts, and emerging vulnerability classes.
Atomic WAF: an enterprise web application firewall with Atomicorp rules, centralized management, reporting, authentication controls, and operational tooling.
Atomic ModSecurity Integrator: a special licensing option for MSPs, MSSPs, OEMs, VARs, reverse proxy providers, and other integrators who want to incorporate Atomicorp ModSecurity rule technology into their own products or services.
Atomic OSSEC: an enterprise OSSEC-based intrusion detection, compliance, and security monitoring platform.
Atomic Protector: workload protection for Linux, web, cloud, data center, and hybrid environments.

For additional information, product evaluations, or technical discussions, visit https://www.atomicorp.com/ or https://modsecurity.io/ (opens in a new tab) .