CVE-2022-47966criticalunder attackransomwareCWE-20

CVE-2022-47966

Published · Updated

Follow this CVE+ Monitor ManageEngine ServiceDesk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDJan 18
1st PoCJan 17
metasploitJan 10
CISA KEV+5d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateStorm-0501 MITRE ATT&CK
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
14 products — because the vulnerable code is not present in the product
Logging Subsystem for Red Hat OpenShift · Red Hat Data Grid 8 · Red Hat Fuse 7 · Red Hat Integration Camel K 1 · Red Hat Integration Camel Quarkus 1 · and others 9
Action required by CISAfederal deadline: 2023-02-13

Apply updates per vendor instructions.

In short

Multiple Zoho ManageEngine products allow attackers to execute arbitrary code remotely through XML processing vulnerabilities in SAML authentication. If your organization uses SAML single sign-on with these products, attackers can take complete control of the system.

Technical detail

CVE-2022-47966 exploits unsafe XSLT processing in Apache Santuario xmlsec 1.4.1 used by ManageEngine products. The attack vector is network-based, targeting SAML authentication endpoints; successful exploitation requires SAML SSO to be configured (and in some products, currently active). The impact is unauthenticated remote code execution with full system privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.