PoC Released for Zoho ManageEngine ADAudit Plus Vulnerability CVE-2022-28219
Security researchers released PoC for a previously disclosed unauthenticated remote code execution vulnerability affecting ADAudit Plus
Summary
Security researchers released PoC for a previously disclosed unauthenticated remote code execution vulnerability affecting ADAudit Plus
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
In March 2022, ManageEngine released a security update to address a critical remote code execution vulnerability affecting ADAudit Plus. The vulnerability is tracked as CVE-2022-28219 and has a CVSSv3 score of 9.8. Security researchers from Horizon3.ai, who reported the vulnerability to ManageEngine, have now released a Proof of Concept (PoC) code and a technical report.
CVE-2022-28219 could allow an attacker to perform unauthenticated remote code execution in the ADAudit Plus server by exploiting XML External Entities (XXE), Java deserialization and path traversal vulnerabilities. A remote unauthenticated attacker could exploit this vulnerability to take control of an affected system.
Previous targeting of Zoho ManageEngine products
Vulnerabilities in Zoho ManageEngine products are frequently targeted as an attack vector
Remediation advice
Affected organisations are encouraged to review the ManageEngine Advisory and apply the necessary updates to the latest release.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 1 July 2022 3:52 pm