CVE-2022-29535
Published: 05 May 2022
Summary
CVE-2022-29535 is a critical-severity SQL Injection (CWE-89) vulnerability in Zohocorp Manageengine Opmanager. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 4.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Zoho ManageEngine OPManager through version 125588 is affected by a SQL injection vulnerability, tracked as CVE-2022-29535 and assigned CWE-89, that exists in a few default reports. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required privileges or user interaction, with complete impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply crafted input to the affected reports and execute arbitrary SQL commands against the underlying database, enabling full read, write, or deletion of data as well as potential takeover of the monitoring application.
Vendor advisories hosted at manageengine.com and the specific security-update page for this CVE describe available patches and configuration changes that address the injection points in the default reports. The associated EPSS score has reached a peak of 0.2219 with a current value of 0.1908.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-33871
Vulnerability details
Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.