Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 99.8%; technical severity is CVSS 9.8.
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).
Who should care
- Teams operating ManageEngine, Manageengine Access Manager Plus, Manageengine Ad360 +20 more
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether ManageEngine, Manageengine Access Manager Plus, Manageengine Ad360 +20 more is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Apply updates per vendor instructions.
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Vendor remediation
Patch and remediation links
Use the vendor source below to confirm the correct fixed version, package or mitigation for your affected product.
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-20
- Affected versions
- Zoho ManageEngine; Zohocorp Manageengine Access Manager Plus (Version: 4.3); Zohocorp Manageengine Ad360 (Version: 4.3); Zohocorp Manageengine Adaudit Plus (Version: 7.0); Zohocorp Manageengine Admanager Plus (Version: 7.1); Zohocorp Manageengine Adselfservice Plus (Version: 6.2); Zohocorp Manageengine Analytics Plus (Version: 5.1); Zohocorp Manageengine Application Control Plus (End Excluding: 10.1.2220.18)
- Published
- 18 January 2023
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 99.8%
- Signal calculated at 88
External references
- Government advisory from www.cisa.gov
- Exploit information from packetstormsecurity.com
- Exploit information from packetstormsecurity.com
- Exploit information from packetstormsecurity.com
- Exploit information from attackerkb.com
- Exploit information from blog.viettelcybersecurity.com
- Release notes from github.com
- Third-party advisory from github.com
- Government advisory from www.cisa.gov
- Exploit information from www.horizon3.ai