Access Control Bypass in Zoho ManageEngine Products
CVE-2022-29081

9.8CRITICAL

Key Information:

Vendor

Zohocorp
Status
Manageengine Password Manager Pro
Manageengine Access Manager Plus
Manageengine Pam360
Vendor
CVE Published:
28 April 2022

What is CVE-2022-29081?

An access control bypass vulnerability exists in Zoho ManageEngine's suite of products, including Access Manager Plus, Password Manager Pro, and PAM360. This flaw allows unauthorized users to exploit specific REST API endpoints, potentially accessing sensitive information. Attackers can leverage the vulnerability through manipulated API requests containing the '../RestAPI' substring, leading to unauthorized access to functions and data, heightening the risk for affected systems.

References

https://www.tenable.com/security/research/tra-2022-14
x_refsource_MISC
https://www.manageengine.com/privileged-session-managemen...
x_refsource_MISC

EPSS Score

14% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.