SECUFOCUSNOW
Home›CVE index›CVE-2022-47966
CISA KEV · Known exploitedCritical

CVE-2022-47966

manageengine access manager plus, manageengine ad360

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Contr...

CVSS
9.8
EPSS
99.8%
100.0% percentile
CISA KEV
Listed
Published
2023.01.19
PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV
Exploit probability99.8%
Technical severityCVSS 9.8

Vulnerability overview

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Contr...

Affected product and versions

Product
manageengine access manager plus, manageengine ad360
Affected versions
< 4.3, 4.3, < 7.0, 7.0, < 7.1, 7.1, < 6.2, 6.2, < 5.1, 5.1, < 6.9, 6.9, < 6.4, 6.4, < 5.7, 5.7, < 12.1, 12.1, < 14.0, 14.0
Fixed versions
4.3, 7.0, 7.1, 6.2, 5.1, 6.9, 6.4, 5.7, 12.1, 14.0, 13.0, 10.1.2220.18, 11.1.2238.6, 10.1.2137.6, 1.1.2243.1, 10.1.2228.11, 10.1.41

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
CISA required action

Apply updates per vendor instructions.

Due date: 2023.02.13
  1. 1
    Identify

    Confirm that manageengine access manager plus, manageengine ad360 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-20
KEV added
2023.01.23
Ransomware use
확인됨
CVE-2022-47966 — manageengine access manager plus, manageengine ad360 | SECUFOCUS NOW