CVE-2022-28810mediumunder attackCWE-798

CVE-2022-28810

Published · Updated

Follow this CVE+ Monitor ManageEngine ServiceDesk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 6.8epss 71%
from disclosure to weaponsame day
Published on NVDApr 18
metasploitApr 9
CISA KEV+323d
Action required by CISAfederal deadline: 2023-03-28

Apply updates per vendor instructions.

In short

Zoho ManageEngine ADSelfService Plus allows authenticated administrators to run dangerous system commands through a policy script feature. Attackers can exploit this easily because the software uses default passwords and doesn't properly check user input in password fields.

Technical detail

CVE-2022-28810 affects ADSelfService Plus before build 6122, allowing authenticated admins to execute arbitrary OS commands as SYSTEM via the policy custom script feature (CWE-798: hardcoded credentials). Pre-conditions include default credentials or partial authentication; command injection occurs due to unsanitized password field input, enabling privilege escalation and system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.