Lucene search

[email protected]CVE-2022-29081

HistoryApr 28, 2022 - 8:15 p.m.

CVE-2022-29081

2022-04-2820:15:08

CWE-22

[email protected]

web.nvd.nist.gov

533

cve-2022-29081

zoho

manageengine

access manager plus

password manager pro

pam360

vulnerability

access-control bypass

rest api

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.517 Medium

EPSS

Percentile

97.6%

JSON

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the …/RestAPI substring.

Affected configurations

NVD

Node

zohocorpmanageengine_access_manager_plusMatch4.0build4000

zohocorpmanageengine_access_manager_plusMatch4.1build4100

zohocorpmanageengine_access_manager_plusMatch4.1build4101

zohocorpmanageengine_access_manager_plusMatch4.2build4200

zohocorpmanageengine_access_manager_plusMatch4.2build4201

zohocorpmanageengine_access_manager_plusMatch4.2build4202

zohocorpmanageengine_access_manager_plusMatch4.2build4203

zohocorpmanageengine_access_manager_plusMatch4.3build4300

zohocorpmanageengine_access_manager_plusMatch4.3build4301

zohocorpmanageengine_pam360Match4.0build4001

zohocorpmanageengine_pam360Match4.0build4002

zohocorpmanageengine_pam360Match4.1build4100

zohocorpmanageengine_pam360Match4.1build4101

zohocorpmanageengine_pam360Match4.5build4500

zohocorpmanageengine_pam360Match4.5build4501

zohocorpmanageengine_pam360Match5.0build5000

zohocorpmanageengine_pam360Match5.0build5001

zohocorpmanageengine_pam360Match5.0build5002

zohocorpmanageengine_pam360Match5.0build5003

zohocorpmanageengine_pam360Match5.0build5004

zohocorpmanageengine_pam360Match5.1build5100

zohocorpmanageengine_pam360Match5.2build5200

zohocorpmanageengine_pam360Match5.3build5300

zohocorpmanageengine_pam360Match5.3build5301

zohocorpmanageengine_pam360Match5.3build5302

zohocorpmanageengine_pam360Match5.4build5400

zohocorpmanageengine_password_manager_proMatch10.1build10103

zohocorpmanageengine_password_manager_proMatch10.1build10104

zohocorpmanageengine_password_manager_proMatch10.2build10200

zohocorpmanageengine_password_manager_proMatch10.3build10300

zohocorpmanageengine_password_manager_proMatch10.3build10301

zohocorpmanageengine_password_manager_proMatch10.3build10302

zohocorpmanageengine_password_manager_proMatch10.4build10400

zohocorpmanageengine_password_manager_proMatch10.4build10401

zohocorpmanageengine_password_manager_proMatch10.4build10402

zohocorpmanageengine_password_manager_proMatch11.111104

zohocorpmanageengine_password_manager_proMatch11.1build_11101

zohocorpmanageengine_password_manager_proMatch11.1build_11102

zohocorpmanageengine_password_manager_proMatch11.1build_11103

zohocorpmanageengine_password_manager_proMatch11.211200

zohocorpmanageengine_password_manager_proMatch11.211201

zohocorpmanageengine_password_manager_proMatch11.3build11300

zohocorpmanageengine_password_manager_proMatch11.3build11301

zohocorpmanageengine_password_manager_proMatch12.0build12000

zohocorpmanageengine_password_manager_proMatch12.0build12001

zohocorpmanageengine_password_manager_proMatch12.0build12002

zohocorpmanageengine_password_manager_proMatch12.0build12003

zohocorpmanageengine_password_manager_proMatch12.0build12004

zohocorpmanageengine_password_manager_proMatch12.0build12005

zohocorpmanageengine_password_manager_proMatch12.0build12006

CPENameOperatorVersion
zohocorp:manageengine_access_manager_pluszohocorp manageengine access manager pluseq4.0
zohocorp:manageengine_access_manager_pluszohocorp manageengine access manager pluseq4.1
zohocorp:manageengine_access_manager_pluszohocorp manageengine access manager pluseq4.2
zohocorp:manageengine_access_manager_pluszohocorp manageengine access manager pluseq4.3
zohocorp:manageengine_pam360zohocorp manageengine pam360eq4.0
zohocorp:manageengine_pam360zohocorp manageengine pam360eq4.1
zohocorp:manageengine_pam360zohocorp manageengine pam360eq4.5
zohocorp:manageengine_pam360zohocorp manageengine pam360eq5.0
zohocorp:manageengine_pam360zohocorp manageengine pam360eq5.1
zohocorp:manageengine_pam360zohocorp manageengine pam360eq5.2

CPE	Name	Operator	Version
zohocorp:manageengine_access_manager_plus	zohocorp manageengine access manager plus	eq	4.0
zohocorp:manageengine_access_manager_plus	zohocorp manageengine access manager plus	eq	4.1
zohocorp:manageengine_access_manager_plus	zohocorp manageengine access manager plus	eq	4.2
zohocorp:manageengine_access_manager_plus	zohocorp manageengine access manager plus	eq	4.3
zohocorp:manageengine_pam360	zohocorp manageengine pam360	eq	4.0
zohocorp:manageengine_pam360	zohocorp manageengine pam360	eq	4.1
zohocorp:manageengine_pam360	zohocorp manageengine pam360	eq	4.5
zohocorp:manageengine_pam360	zohocorp manageengine pam360	eq	5.0
zohocorp:manageengine_pam360	zohocorp manageengine pam360	eq	5.1
zohocorp:manageengine_pam360	zohocorp manageengine pam360	eq	5.2

Rows per page:

1-10 of 201

References

www.manageengine.com/privileged-session-management/advisory/cve-2022-29081.html

www.tenable.com/security/research/tra-2022-14

Social References

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.517 Medium

EPSS

Percentile

97.6%

JSON

Related for CVE-2022-29081

checkpoint_advisories1 nessus3 nvd1 prion1 cvelist1