Zoho is urging its customers to address a critical SQL Injection vulnerability, tracked as CVE-2022-47523, that affects multiple ManageEngine products.
“This security advisory is to let you know that a high severity vulnerability was detected in ManageEngine Password Manager Pro.” reads the advisory published by Zoho. “An SQL Injection vulnerability(CVE-2022-47523) was discovered in Password Manager Pro.”
An attacker can trigger this vulnerability to execute custom queries, and access the database records using the vulnerable request.
The vendor addressed the flaw by adding proper validation and escaping special characters.
The flaw impacts Password Manager Pro, versions 12200 and below.
“We identified a SQL injection vulnerability (CVE-2022-47523) in our internal framework that would grant access to all the Password Manager Pro users to the backend database. It has now been fixed.” Zoho added.
Below are the steps to upgrade the installs:
In September, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a security flaw in Zoho ManageEngine, tracked as CVE-2022-35405 (CVSS score 9.8), to its Known Exploited Vulnerabilities Catalog.
The CVE-2022-35405 flaw is a remote code execution vulnerability that impacts ManageEngine PAM360, Password Manager Pro, and Access Manager Plus.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, SQL Injection)
[adrotate banner=”5″]
[adrotate banner=”13″]
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows flaws to its Known Exploited…
Ivanti addressed two Endpoint Manager Mobile (EPMM) software vulnerabilities that have been exploited in limited…
Microsoft Patch Tuesday security updates for May 2025 addressed 75 security flaws across multiple products, including…
Fortinet fixed a critical remote code execution zero-day vulnerability actively exploited in attacks targeting FortiVoice…
Interlock Ransomware 's attack on a defense contractor exposed global defense supply chain details, risking…
Marks and Spencer (M&S) confirms that threat actors stole customer data in the ransomware attack…
This website uses cookies.
