Zoho · ManageEngine
CVE-2022-28810
Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability
What it is
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the policy custom script feature. Due to the use of a default administrator password, attackers may be able to abuse this functionality with minimal effort. Additionally, a remote and partially authenticated attacker may be able to inject arbitrary commands into the custom script due to an unsanitized password field.
CISA: Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 28, 2023
- Added to the CISA list
- March 7, 2023
- Published
- April 18, 2022
- Severity
- Medium 6.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 71% in the top 0.6% of all known vulnerabilities
- Weakness
- CWE-78 CWE-259
- More details
- NVD · CVE.org · CISA
All references (4)
- https://www.manageengine.com/products/self-service-password/kb/cve-2022-28810.html
- http://packetstormsecurity.com/files/166816/ManageEngine-ADSelfService-Plus-Custom-Script-Execution.html
- https://github.com/rapid7/metasploit-framework/pull/16475
- https://www.rapid7.com/blog/post/2022/04/14/cve-2022-28810-manageengine-adselfservice-plus-authenticated-comm…
More exploited flaws from Zoho
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jan 23, 2023 | Multiple Products Remote Code Execution | ManageEngine | Critical 9.8 | 99.8% |
| Sep 22, 2022 | Multiple Products Remote Code Execution | ManageEngine | Critical 9.8 | 99.9% |
| Nov 3, 2021 | ServiceDesk Plus (SDP) File Upload | ManageEngine | High 7.5 | 63% |
| Nov 3, 2021 | Desktop Central File Upload | ManageEngine | Critical 9.8 | 99.9% |
| Nov 3, 2021 | ADSelfService Plus Authentication Bypass | ManageEngine | Critical 9.8 | 99% |
| Dec 10, 2021 | Authentication Bypass | Desktop Central | Critical 9.8 | 99.9% |
| Dec 1, 2021 | ManageEngine ServiceDesk Authentication Bypass | ManageEngine ServiceDesk Plus (SDP) | Critical 9.8 | 99.8% |
| Dec 1, 2021 | ManageEngine ServiceDesk Plus Remote Code Execution | ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Critical 9.8 | 93% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.