CVE-2022-35405

🗓️ 19 Jul 2022 14:51:47Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 891 Views🌐 WEB

Zoho ManageEngine Password Manager Pro and PAM360 Vulnerabilit

Reporter	Title	Published	Views	Family All 29
zdt	Zoho Password Manager Pro XML-RPC Java Deserialization Exploit	4 Aug 202200:00	–	zdt
GithubExploit	Exploit for Deserialization of Untrusted Data in Zohocorp Manageengine_Access_Manager_Plus	18 Jul 202220:52	–	githubexploit
ATTACKERKB	CVE-2022-35405	19 Jul 202200:00	–	attackerkb
BDU FSTEC	The vulnerability of the xmlrpc component in the software solutions for control, management, and auditing of Zoho ManageEngine Password Manager Pro, as well as the software solution for managing privileged sessions in Zoho ManageEngine Access Manager Plus, allows a perpetrator to execute arbitrary code.	28 Sep 202200:00	–	bdu_fstec
Circl	CVE-2022-35405	19 Jul 202218:40	–	circl
CISA KEV Catalog	Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability	22 Sep 202200:00	–	cisa_kev
CNNVD	ZOHO ManageEngine Password Manager Pro 代码问题漏洞	19 Jul 202200:00	–	cnnvd
Check Point Advisories	Zoho Multiple Products Remote Code Execution (CVE-2022-35405)	23 Oct 202200:00	–	checkpoint_advisories
Cvelist	CVE-2022-35405	19 Jul 202214:51	–	cvelist
Kitploit	CVE-2022-35405	28 Aug 202602:59	–	kitploit

NVD

Node

OR

zohocorp manageengine_access_manager_plusRange<4.3

zohocorp manageengine_access_manager_plusMatch4.3build4300

zohocorp manageengine_access_manager_plusMatch4.3build4301

zohocorp manageengine_access_manager_plusMatch4.3build4302

zohocorp manageengine_pam360Range<5.5

zohocorp manageengine_pam360Match5.5build5500

zohocorp manageengine_password_manager_proRange<12.1

zohocorp manageengine_password_manager_proMatch12.1build12100

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/167918/Zoho-Password-Manager-Pro-XML-RPC-Java-Deserialization.html
manageengine	www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-35405.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
serialized object in XML-RPC request body	path	/xmlrpc	Unauthenticated remote code execution via crafted XML-RPC request to /xmlrpc using Java deserialization.	CWE-502
<serializable> base64-encoded payload</serializable>	path	/xmlrpc	Unauthenticated remote code execution via crafted XML-RPC request to /xmlrpc using Java deserialization.	CWE-502

17 Jun 2026 04:51Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.99927

SSVC

CWE-502 In Wild

cve-2022-35405 zoho manageengine password manager pro pam360 vulnerability unauthenticated remote code execution nvd