CVE-2022-35405

🗓️ 19 Jul 2022 14:51:47Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 906 Views🌐 WEB

Zoho ManageEngine Password Manager Pro and PAM360 Vulnerabilit

Reporter	Title	Published	Views	Family All 30
zdt	Zoho Password Manager Pro XML-RPC Java Deserialization Exploit	4 Aug 202200:00	–	zdt
GithubExploit	Exploit for Deserialization of Untrusted Data in Zohocorp Manageengine_Access_Manager_Plus	18 Jul 202220:52	–	githubexploit
attackerkb	CVE-2022-35405	19 Jul 202200:00	–	attackerkb
BDU FSTEC	The vulnerability of the xmlrpc component in the software solutions for control, management, and auditing of Zoho ManageEngine Password Manager Pro, as well as the software solution for managing privileged sessions in Zoho ManageEngine Access Manager Plus, allows a perpetrator to execute arbitrary code.	28 Sep 202200:00	–	bdu_fstec
Circl	CVE-2022-35405	19 Jul 202218:40	–	circl
CISA KEV Catalog	Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability	22 Sep 202200:00	–	cisa_kev
CNNVD	ZOHO ManageEngine Password Manager Pro 代码问题漏洞	19 Jul 202200:00	–	cnnvd
Check Point Advisories	Zoho Multiple Products Remote Code Execution (CVE-2022-35405)	23 Oct 202200:00	–	checkpoint_advisories
Cvelist	CVE-2022-35405	19 Jul 202214:51	–	cvelist
Kitploit	CVE-2022-35405	5 Oct 202613:02	–	kitploit

NVD

Node

OR

zohocorp manageengine_access_manager_plusRange<4.3

zohocorp manageengine_access_manager_plusMatch4.3build4300

zohocorp manageengine_access_manager_plusMatch4.3build4301

zohocorp manageengine_access_manager_plusMatch4.3build4302

zohocorp manageengine_pam360Range<5.5

zohocorp manageengine_pam360Match5.5build5500

zohocorp manageengine_password_manager_proRange<12.1

zohocorp manageengine_password_manager_proMatch12.1build12100

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html
manageengine	www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
serializable	request body	/xmlrpc	XML-RPC Java deserialization vulnerability exploitable via crafted serialized data sent to /xmlrpc to achieve RCE (CommonsBeanutils1 gadget).	CWE-502

17 Jun 2026 04:51Current

9.7Critical risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.99924

SSVC

CWE-502 In Wild

cve-2022-35405 zoho manageengine password manager pro pam360 vulnerability unauthenticated remote code execution nvd