Lucene search

[email protected]CVE-2022-43672

HistoryNov 12, 2022 - 4:15 a.m.

CVE-2022-43672

2022-11-1204:15:10

CWE-89

[email protected]

web.nvd.nist.gov

cve-2022-43672

zoho

manageengine

password manager pro

pam360

access manager plus

sql injection

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.028 Low

EPSS

Percentile

90.7%

JSON

Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671.

Affected configurations

NVD

Node

zohocorpmanageengine_access_manager_plusRange<4.3

zohocorpmanageengine_access_manager_plusMatch4.3build4300

zohocorpmanageengine_access_manager_plusMatch4.3build4301

zohocorpmanageengine_access_manager_plusMatch4.3build4302

zohocorpmanageengine_access_manager_plusMatch4.3build4303

zohocorpmanageengine_access_manager_plusMatch4.3build4304

zohocorpmanageengine_access_manager_plusMatch4.3build4305

zohocorpmanageengine_pam360Range<5.7

zohocorpmanageengine_pam360Match5.7build5700

zohocorpmanageengine_pam360Match5.7build5710

zohocorpmanageengine_password_manager_proRange<12.1

zohocorpmanageengine_password_manager_proMatch12.1build12100

zohocorpmanageengine_password_manager_proMatch12.1build12101

zohocorpmanageengine_password_manager_proMatch12.1build12110

zohocorpmanageengine_password_manager_proMatch12.1build12120

zohocorpmanageengine_password_manager_proMatch12.1build12121

CPENameOperatorVersion
zohocorp:manageengine_access_manager_pluszohocorp manageengine access manager pluslt4.3
zohocorp:manageengine_pam360zohocorp manageengine pam360lt5.7
zohocorp:manageengine_password_manager_prozohocorp manageengine password manager prolt12.1

CPE	Name	Operator	Version
zohocorp:manageengine_access_manager_plus	zohocorp manageengine access manager plus	lt	4.3
zohocorp:manageengine_pam360	zohocorp manageengine pam360	lt	5.7
zohocorp:manageengine_password_manager_pro	zohocorp manageengine password manager pro	lt	12.1

References

www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-43672.html

Social References

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.028 Low

EPSS

Percentile

90.7%

JSON

Related for CVE-2022-43672

cvelist2 prion2 nvd2 cve1