Lucene search
SAINT CorporationSAINT:27C5127555C4E549C099885D4DCD41D9HistoryFeb 17, 2023 - 12:00 a.m.
Zoho ManageEngine ServiceDesk Plus SAMLResponse command execution
2023-02-1700:00:00
SAINT Corporation
download.saintcorporation.com
118
0.974 High
EPSS
Percentile
99.9%
Added: 02/17/2023
Background
Zoho ManageEngine ServiceDesk Plus is IT helpdesk software.
Problem
A vulnerability in an outdated Apache Santuario library in ServiceDesk Plus allows a remote, unauthenticated attacker to execute arbitrary commands by sending a specially crafted **SAMLResponse** parameter to the SAML endpoint.
Resolution
Upgrade to ServiceDesk Plus 14004 or higher.
References
<https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html>
<https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/>
Limitations
The target must have been configured with SAML-based SSO at least once in the past in order to be exploitable.
Platforms
Windows
Related
hivepro
hivepro
A Critical Vulnerability That Affects ManageEngine Products
2023-01-17 09:59:34
Actors, Threats and Vulnerabilities 16 January 2023 – 22 January 2023
2023-01-25 03:14:57
thn
thn
packetstorm
packetstorm
Zoho ManageEngine ServiceDesk Plus 14003 Remote Code Execution
2023-02-07 00:00:00
ManageEngine ADSelfService Plus Unauthenticated SAML Remote Code Execution
2023-02-08 00:00:00
Zoho ManageEngine Endpoint Central / MSP 10.1.2228.10 Remote Code Execution
2023-02-09 00:00:00
talosblog
talosblog
Lazarus Group exploits ManageEngine vulnerability to deploy QuiteRAT
2023-08-24 12:02:13
Lazarus Group's infrastructure reuse leads to discovery of new malware
2023-08-24 12:04:22
impervablog
impervablog
ManageEngine Vulnerability CVE-2022-47966
2023-01-20 18:16:02
nessus
nessus
ManageEngine Access Manager Plus Unauthenticated RCE (CVE-2022-47966)
2023-02-21 00:00:00
ManageEngine ServiceDesk Plus Unauthenticated RCE (CVE-2022-47966)
2023-02-07 00:00:00
ManageEngine ServiceDesk Plus MSP < 13.0 Build 13001 RCE
2023-06-07 00:00:00
cve
cve
CVE-2022-47966
2023-01-18 18:15:00
zdt
zdt
rapid7blog
rapid7blog
CVE-2022-47966: Rapid7 Observed Exploitation of Critical ManageEngine Vulnerability
2023-01-19 17:46:15
Metasploit Weekly Wrap-Up 01/12/24
2024-01-12 21:25:19
Metasploit Wrap-Up 03/08/2024
2024-03-08 17:00:00
cisa_kev
cisa_kev
Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
2023-01-23 00:00:00
metasploit
metasploit
ManageEngine Endpoint Central Unauthenticated SAML RCE
2023-01-29 07:47:22
ManageEngine ADSelfService Plus Unauthenticated SAML RCE
2023-01-26 20:53:14
ManageEngine ServiceDesk Plus Unauthenticated SAML RCE
2023-01-23 23:55:45
redhatcve
redhatcve
CVE-2022-47966
2023-01-23 18:05:29
prion
prion
Remote code execution
2023-01-18 18:15:00
cvelist
cvelist
CVE-2022-47966
2023-01-18 00:00:00
githubexploit
githubexploit
Exploit for Vulnerability in Zohocorp Manageengine Access Manager Plus
2023-01-19 16:06:56
Exploit for Vulnerability in Zohocorp Manageengine Access Manager Plus
2023-01-23 15:49:10
Exploit for Vulnerability in Zohocorp Manageengine Access Manager Plus
2023-01-23 11:33:29
saint
saint
Zoho ManageEngine ServiceDesk Plus SAMLResponse command execution
2023-02-17 00:00:00
nuclei
nuclei
ManageEngine - Remote Command Execution
2023-01-19 19:59:16
mmpc
mmpc
mssecure
mssecure
malwarebytes
malwarebytes
trellix
trellix
The Bug Report January 2023 Edition
2023-02-01 00:00:00
The Bug Report January 2023 Edition
2023-02-01 00:00:00
ics
ics
attackerkb
attackerkb
CVE-2022-47966
2023-01-20 00:00:00