Rewterz Threat Advisory – CVE-2022-35405 – Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus Vulnerability

Severity

High

Analysis Summary

CVE-2022-35405

Zoho ManageEngine PAM360, Password Manager Pro, and Access Manager Plus could allow a remote attacker to execute arbitrary code on the system, caused by an unspecified flaw. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system. 

Impact

• Code Execution

Indicators Of Compromise

CVE

• CVE-2022-35405

Affected Vendors

Zoho

Affected Products

• Zoho ManageEngine Access Manager Plus 4301
• Zoho ManageEngine Access Manager Plus 4302
• Zoho ManageEngine Password Manager Pro 12100
• Zoho ManageEngine Password Manager Pro 12099
• Zoho ManageEngine PAM360 5500
• Zoho ManageEngine PAM360 5499

Remediation

Refer to ManageEngine Web site for patch, upgrade or suggested workaround information.

ManageEngine Website