CVE-2022-24306
Published: 02 March 2022
Summary
CVE-2022-24306 is a critical-severity Incorrect Authorization (CWE-863) vulnerability in Zohocorp Manageengine Sharepoint Manager Plus. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Zoho ManageEngine SharePoint Manager Plus versions prior to 4329 contain an authorization mishandling flaw tracked as CVE-2022-24306 and assigned CWE-863. The vulnerability received a CVSS 3.1 base score of 9.8, reflecting network-accessible exploitation that requires no credentials or user interaction and can result in complete loss of confidentiality, integrity, and availability.
An unauthenticated remote attacker can exploit the flaw to perform account takeover, thereby gaining the privileges of any targeted user within the SharePoint management environment. Because the issue stems from improper authorization checks rather than authentication bypass, an attacker who reaches the affected instance can directly assume control of accounts and perform arbitrary administrative actions.
The vendor's release notes for build 4329 address the authorization defect and are referenced as the corrective update. Organizations should upgrade SharePoint Manager Plus to version 4329 or later to eliminate the exposure.
EPSS for the CVE has remained flat at 0.0559 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29204
Vulnerability details
Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Periodic review and update of procedures reduces incorrect authorization implementations over time.
Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.
Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.
The authorization process and usage restrictions help prevent incorrect authorization for remote access types.
Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.
Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.
Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
Ensures authorization decisions for external system use are correctly implemented and enforced.