Zoho ManageEngine多款产品远程代码执行漏洞

详细信息

漏洞类型

其他

漏洞描述

由于使用了过时的第三方依赖项Apache Santuario，多个ManageEngine产品可能允许远程攻击者在系统上执行任意代码。 1、配置了基于SAML的SSO且当前处于活动状态。 2、无论当前基于SAML SSO的状态如何，过去至少配置过一次基于SAML的SSO。 当满足上述SAML SSO条件时，此漏洞允许未经验证的攻击者执行任意代码。

修复建议

有关修补程序、升级或建议的解决方法信息，请参阅ManageEngine网站： https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html

参考链接

• https://manageengine.com

  NVD

• https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html

  CVE · Vendor Advisory · Patch

• https://github.com/apache/santuario-xml-security-java/tags?after=1.4.6

  CVE · Third Party Advisory · Release Notes

• https://access.redhat.com/security/cve/cve-2022-47966
• https://cxsecurity.com/cveshow/CVE-2022-47966/
• http://packetstormsecurity.com/files/170882/Zoho-ManageEngine-ServiceDesk-Plus-14003-Remote-Code-Execution.html

  CVE · Exploit · Third Party Advisory · VDB Entry

• https://attackerkb.com/topics/gvs0Gv8BID/cve-2022-47966/rapid7-analysis

  CVE · Exploit · Third Party Advisory

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a

  CVE · Third Party Advisory · US Government Resource

• https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/

  CVE · Exploit · Third Party Advisory

• https://blog.viettelcybersecurity.com/saml-show-stopper/

  CVE · Exploit · Third Party Advisory

• https://github.com/horizon3ai/CVE-2022-47966

  CVE · Third Party Advisory

• http://packetstormsecurity.com/files/170925/ManageEngine-ADSelfService-Plus-Unauthenticated-SAML-Remote-Code-Execution.html

  CVE · Exploit · Third Party Advisory · VDB Entry

• http://packetstormsecurity.com/files/170943/Zoho-ManageEngine-Endpoint-Central-MSP-10.1.2228.10-Remote-Code-Execution.html

  CVE · Exploit · Third Party Advisory · VDB Entry

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-47966

  NVD · US Government Resource