ByteOS

Product:ManageEngine

Added At:23 Jan, 2023

Due At:13 Feb, 2023

Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Multiple Zoho ManageEngine products contain an unauthenticated remote code execution vulnerability due to the usage of an outdated third-party dependency, Apache Santuario.

Used in Ransomware

Known

CWE

N/A

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html; https://nvd.nist.gov/vuln/detail/CVE-2022-47966

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:18 Jan, 2023 | 00:00

Updated At:30 Jul, 2025 | 01:37

▼CVE Numbering Authority (CNA)

Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6	N/A
https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html	N/A
http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html	N/A
http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html	N/A
http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html	N/A
https://blog.viettelcybersecurity.com/saml-show-stopper/	N/A
https://github.com/horizon3ai/CVE-2022-47966	N/A
https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/	N/A
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a	N/A
https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis	N/A

Hyperlink: https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6

Resource: N/A

Hyperlink: https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html

Resource: N/A

Hyperlink: http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html

Resource: N/A

Hyperlink: http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html

Resource: N/A

Hyperlink: http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html

Resource: N/A

Hyperlink: https://blog.viettelcybersecurity.com/saml-show-stopper/

Resource: N/A

Hyperlink: https://github.com/horizon3ai/CVE-2022-47966

Resource: N/A

Hyperlink: https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/

Resource: N/A

Hyperlink: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a

Resource: N/A

Hyperlink: https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6	x_transferred
https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html	x_transferred
http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html	x_transferred
http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html	x_transferred
http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html	x_transferred
https://blog.viettelcybersecurity.com/saml-show-stopper/	x_transferred
https://github.com/horizon3ai/CVE-2022-47966	x_transferred
https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/	x_transferred
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a	x_transferred
https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis	x_transferred

Hyperlink: https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6

Resource:

x_transferred

Hyperlink: https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html

Resource:

x_transferred

Hyperlink: http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html

Resource:

x_transferred

Hyperlink: http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html

Resource:

x_transferred

Hyperlink: http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html

Resource:

x_transferred

Hyperlink: https://blog.viettelcybersecurity.com/saml-show-stopper/

Resource:

x_transferred

Hyperlink: https://github.com/horizon3ai/CVE-2022-47966

Resource:

x_transferred

Hyperlink: https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/

Resource:

x_transferred

Hyperlink: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a

Resource:

x_transferred

Hyperlink: https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis

Resource:

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-20	CWE-20 Improper Input Validation

Type: CWE

CWE ID: CWE-20

Description: CWE-20 Improper Input Validation

Metrics

Version	Base score	Base severity	Vector
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2023-01-23

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-47966

Timeline

Event	Date
CVE-2022-47966 added to CISA KEV	2023-01-23 00:00:00

Event: CVE-2022-47966 added to CISA KEV

Date: 2023-01-23 00:00:00

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:18 Jan, 2023 | 18:15

Updated At:16 Sep, 2024 | 19:45

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2023-01-23	2023-02-13	Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability	Apply updates per vendor instructions.

Date Added: 2023-01-23

Due Date: 2023-02-13

Vulnerability Name: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CPE Matches

cpe:2.3:a:zohocorp:manageengine_access_manager_plus:*:*:*:*:*:*:*:*

>>manageengine_access_manager_plus>>Versions before 4.3(exclusive)

cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4303:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4304:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4305:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4306:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4307:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_ad360:*:*:*:*:*:*:*:*

>>manageengine_ad360>>Versions before 4.3(exclusive)

cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4300:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4302:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4303:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4304:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4305:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4306:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4308:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_ad360:4.3:4309:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*

>>manageengine_adaudit_plus>>Versions before 7.0(exclusive)

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7000:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7002:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7003:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7004:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7005:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7006:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7007:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7008:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7050:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7051:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7052:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7053:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7054:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7055:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7060:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7062:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7063:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7065:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7080:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_admanager_plus:*:*:*:*:*:*:*:*

>>manageengine_admanager_plus>>Versions before 7.1(exclusive)

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7100:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7101:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7102:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7110:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7111:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7112:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7113:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7114:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7115:*:*:*:*:*:*

cpe:2.3:a:zohocorp:manageengine_admanager_plus:7.1:7116:*:*:*:*:*:*