CVE-2022-35405

🗓️ 19 Jul 2022 14:51:47Reported by mitreType

cve

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 854 Views🌐 WEB

Zoho ManageEngine Password Manager Pro and PAM360 Vulnerabilit

Reporter	Title	Published	Views	Family All 28
0day.today	Zoho Password Manager Pro XML-RPC Java Deserialization Exploit	4 Aug 202200:00	–	zdt
GithubExploit	Exploit for Deserialization of Untrusted Data in Zohocorp Manageengine_Access_Manager_Plus	18 Jul 202220:52	–	githubexploit
ATTACKERKB	CVE-2022-35405	19 Jul 202200:00	–	attackerkb
BDU FSTEC	The vulnerability of the xmlrpc component in the software solutions for control, management, and auditing of Zoho ManageEngine Password Manager Pro, as well as the software solution for managing privileged sessions in Zoho ManageEngine Access Manager Plus, allows a perpetrator to execute arbitrary code.	28 Sep 202200:00	–	bdu_fstec
Circl	CVE-2022-35405	19 Jul 202218:40	–	circl
CISA KEV Catalog	Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability	22 Sep 202200:00	–	cisa_kev
CNNVD	ZOHO ManageEngine Password Manager Pro 代码问题漏洞	19 Jul 202200:00	–	cnnvd
Check Point Advisories	Zoho Multiple Products Remote Code Execution (CVE-2022-35405)	23 Oct 202200:00	–	checkpoint_advisories
Cvelist	CVE-2022-35405	19 Jul 202214:51	–	cvelist
Malwarebytes	Update now! Proof of concept code to be released for Zoho ManageEngine vulnerability	17 Jan 202307:00	–	malwarebytes

NVD

Node

zohocorp manageengine_access_manager_plusRange<4.3

OR

zohocorp manageengine_access_manager_plusMatch4.3build4300

OR

zohocorp manageengine_access_manager_plusMatch4.3build4301

OR

zohocorp manageengine_access_manager_plusMatch4.3build4302

OR

zohocorp manageengine_pam360Range<5.5

OR

zohocorp manageengine_pam360Match5.5build5500

OR

zohocorp manageengine_password_manager_proRange<12.1

OR

zohocorp manageengine_password_manager_proMatch12.1build12100

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html
manageengine	www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
XMLRPC request containing serialized data (base64-encoded)	path	/xmlrpc	Unauthenticated remote code execution via Java deserialization in Zoho Password Manager Pro / XML-RPC endpoint	CWE-502

17 Jun 2026 04:51Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.9994

SSVC

CWE-502 In Wild

cve-2022-35405 zoho manageengine password manager pro pam360 vulnerability unauthenticated remote code execution nvd