CVE-2022-29081

Deeper analysis

Zoho ManageEngine Access Manager Plus before version 4302, Password Manager Pro before 12007, and PAM360 before 5401 contain an access-control bypass vulnerability on several REST API endpoints including SSOutAction, SSLAction, LicenseMgr, GetProductDetails, GetDashboard, FetchEvents, and Synchronize. The flaw, tracked as CWE-22, is triggered when an attacker supplies the ../RestAPI substring in requests to those URLs, allowing unauthorized access despite the products' intended controls. The issue carries a CVSS 3.1 score of 9.8 reflecting network-accessible exploitation with no required credentials or user interaction.

An unauthenticated remote attacker can leverage the bypass to reach restricted functionality on the affected REST endpoints, resulting in full compromise of confidentiality, integrity, and availability of the privileged-access management systems.

Vendor advisories at the referenced ManageEngine and Tenable URLs describe the affected builds and direct administrators to apply the fixed releases (Access Manager Plus 4302, Password Manager Pro 12007, and PAM360 5401) to close the exposure. The associated EPSS score stands at 0.8803 with no material post-disclosure climb from a lower baseline.