CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2023-01-18
Zoho ManageEngine Multiple On-Premise Products SAML XML Signature Verification Remote Code Execution (RCE) Advisory (CVE-2022-47966)
[Affected Scope] Zoho ManageEngine on-premise products with SAML SSO configured or previously enabled (e.g., ServiceDesk Plus through 14003, ADSelfService Plus through 6210, Endpoint Central through 10.1.2228.10)
[Impact] Unauthenticated remote attackers can execute arbitrary code with SYSTEM/Administrator privileges by sending a specially crafted SAML response containing malicious XSLT payloads
[Mitigation] Immediately upgrade the affected ManageEngine products to the latest patched versions, or temporarily disable SAML SSO and restrict access to SAML endpoints