Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache San
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Multiple Zoho ManageEngine on-premise products, including ServiceDesk Plus, Endpoint Central, Password Manager Pro, and many other IT management and security tools, are affected by a flaw that lets remote attackers run arbitrary code on the server. The issue stems from the use of an outdated XML security library that leaves certain protections for the application to implement, which these products did not do.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 10
GitHub · apache/santuario-xml-security-java
manageengine.com
packetstormsecurity.com
blog.viettelcybersecurity.com
GitHub · horizon3ai/CVE-2022-47966
attackerkb.com
Questions about CVE-2022-47966
What does this mean?
An unauthenticated attacker can execute arbitrary code on an affected ManageEngine on-premise product, which is remote code execution.Source: manageengine.com
Am I affected, and how do I check?
Only on-premise ManageEngine products listed in the advisory are in scope; on-demand and cloud products are not affected. The advisory applies only when SAML SSO is or was enabled in the setup. For some products SAML SSO must be configured and currently active, while for others it only needs to have been configured at least once. Check the product's SAML SSO settings and the advisory's product list to see which case applies.Source: manageengine.com
What should I do about it?
The checked facts do not name a fixed version, so check the vendor advisory for an updated build of the affected product.Source: manageengine.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-01-23, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
The checked facts do not list a workaround. They also do not say whether turning off SAML SSO removes exposure, since the advisory also covers setups where SAML SSO was enabled in the past.Source: manageengine.com