CVE-2022-36923
High
Description
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.
SeverityHigh
CVSS7.5
Exploit probability—
ProductZohocorp Manageengine Firewall Analyzer
PublishedAug 10, 2022
First seenAug 10, 2022
Weakness typeCWE-284Improper access control
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zohocorp manageengine_firewall_analyzer | 12.5, 12.6 | — |
| zohocorp manageengine_netflow_analyzer | 12.5, 12.6 | — |
| zohocorp manageengine_network_configuration_manager | 12.5, 12.6 | — |
| zohocorp manageengine_opmanager | 12.5, 12.6 | — |
| zohocorp manageengine_opmanager_msp | 12.5, 12.6 | — |
| zohocorp manageengine_opmanager_plus | 12.5, 12.6 | — |
| zohocorp manageengine_oputils | 12.5, 12.6 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.