⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2023-02-13.
CVE-2022-47966
Severity
9.8CRITICAL
EPSS
94.4%
top 0.03%
CISA KEV
KEVRansomware
Added 2023-01-23
Due 2023-02-13
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedJan 18
KEV addedJan 23
KEV dueFeb 13
Latest updateSep 26
CISA Required Action: Apply updates per vendor instructions.
Description
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManage…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages22 packages
Patches
🔴Vulnerability Details
3CVEList▶
CVE-2022-47966: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xml↗2023-01-18
GHSA▶
GHSA-mqq7-v29v-25f6: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache xmlsec (aka X↗2023-01-18