CVE-2022-37024
High
Description
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution.
SeverityHigh
CVSS8.8
Exploit probability—
ProductZohocorp Manageengine Firewall Analyzer
PublishedAug 10, 2022
First seenAug 10, 2022
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zohocorp manageengine_firewall_analyzer | 12.5, 12.6 | — |
| zohocorp manageengine_netflow_analyzer | 12.5, 12.6 | — |
| zohocorp manageengine_network_configuration_manager | 12.5, 12.6 | — |
| zohocorp manageengine_opmanager | 12.5, 12.6 | — |
| zohocorp manageengine_opmanager_msp | 12.5, 12.6 | — |
| zohocorp manageengine_opmanager_plus | 12.5, 12.6 | — |
| zohocorp manageengine_oputils | 12.5, 12.6 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.