CVE-2022-38772
High
Description
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.
SeverityHigh
CVSS8.8
Exploit probability—
ProductZohocorp Manageengine Netflow Analyzer
PublishedAug 29, 2022
First seenAug 29, 2022
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zohocorp manageengine_netflow_analyzer | 12.5, 12.6 | — |
| zohocorp manageengine_network_configuration_manager | 12.5, 12.6 | — |
| zohocorp manageengine_opmanager | 12.5, 12.6 | — |
| zohocorp manageengine_opmanager_msp | 12.5, 12.6 | — |
| zohocorp manageengine_opmanager_plus | 12.5, 12.6 | — |
| zohocorp manageengine_oputils | 12.5, 12.6 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.