Executive Summary

Informations
Name CVE-2022-47966 First vendor Publication 2023-01-18
Vendor Cve Last vendor Modification 2023-09-11

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Overall CVSS Score 9.8
Base Score 9.8 Environmental Score 9.8
impact SubScore 5.9 Temporal Score 9.8
Exploitabality Sub Score 3.9
 
Attack Vector Network Attack Complexity Low
Privileges Required None User Interaction None
Scope Unchanged Confidentiality Impact High
Integrity Impact High Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score N/A Attack Range N/A
Cvss Impact Score N/A Attack Complexity N/A
Cvss Expoit Score N/A Authentication N/A
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-47966

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 16
Application 33
Application 31
Application 67
Application 291
Application 49
Application 41
Application 2
Application 19
Application 1
Application 1
Application 17
Application 1
Application 38
Application 279
Application 2
Application 4
Application 386
Application 141
Application 8
Application 2

SAINT Exploits

Description Link
Zoho ManageEngine ServiceDesk Plus SAMLResponse command execution More info here

Sources (Detail)

Source Url
MISC http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plu...
http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-U...
http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Centra...
https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis
https://blog.viettelcybersecurity.com/saml-show-stopper/
https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6
https://github.com/horizon3ai/CVE-2022-47966
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a
https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/
https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Date Informations
2024-02-02 02:40:49
  • Multiple Updates
2024-02-01 12:28:31
  • Multiple Updates
2023-11-30 02:27:31
  • Multiple Updates
2023-09-12 00:28:01
  • Multiple Updates
2023-09-05 13:36:14
  • Multiple Updates
2023-09-05 01:27:54
  • Multiple Updates
2023-09-02 13:33:51
  • Multiple Updates
2023-09-02 01:28:20
  • Multiple Updates
2023-08-12 13:40:36
  • Multiple Updates
2023-08-12 01:27:37
  • Multiple Updates
2023-08-11 13:31:30
  • Multiple Updates
2023-08-11 01:28:28
  • Multiple Updates
2023-08-06 13:29:00
  • Multiple Updates
2023-08-06 01:27:18
  • Multiple Updates
2023-08-04 13:29:27
  • Multiple Updates
2023-08-04 01:27:40
  • Multiple Updates
2023-07-14 13:29:23
  • Multiple Updates
2023-07-14 01:27:22
  • Multiple Updates
2023-04-13 02:16:05
  • Multiple Updates
2023-03-29 02:29:14
  • Multiple Updates
2023-03-28 12:27:27
  • Multiple Updates
2023-03-07 02:15:02
  • Multiple Updates
2023-03-02 13:10:52
  • Multiple Updates
2023-03-02 02:15:48
  • Multiple Updates
2023-02-21 21:27:12
  • Multiple Updates
2023-02-10 00:27:32
  • Multiple Updates
2023-02-09 00:27:29
  • Multiple Updates
2023-02-08 21:27:25
  • Multiple Updates
2023-02-08 00:27:31
  • Multiple Updates
2023-01-26 00:27:15
  • Multiple Updates
2023-01-19 00:27:16
  • First insertion