Cyber Resilience

CVE-2022-38772

Zohocorp Manageengine Opmanager 12.5 … 12.6

High EPSS
Published
29 August 2022
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.78 99.5th percentile
Risk Priority 87 floored blend · peak EPSS

Summary

CVE-2022-38772 is a high-severity an unspecified weakness vulnerability in Zohocorp Manageengine Opmanager. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils versions prior to 125658, 126003, 126105, and 126120 contain a vulnerability that permits authenticated users to alter database entries, resulting in remote code execution through the NMAP feature. The issue carries a CVSS 3.1 score of 8.8 and affects multiple ManageEngine IT operations management products that share the same underlying code base.

An attacker with valid low-privileged credentials can exploit the flaw over the network without user interaction to modify database records and trigger arbitrary code execution, achieving full compromise of confidentiality, integrity, and availability on the affected server.

Vendor advisories published at manageengine.com and https://www.manageengine.com/itom/advisory/cve-2022-38772.html direct customers to apply the listed fixed builds to eliminate the database modification path that leads to NMAP-based code execution.

The associated EPSS score has remained flat at its peak value of 0.3914 since disclosure, indicating no material increase in observed exploitation interest.

EU & UK References

Vulnerability Data

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.

CWE(s)
NVD-CWE-noinfo

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Authenticated remote attacker can alter database entries to achieve RCE via the NMAP feature.
attack.mitre.org →
T1059 Command and Scripting Interpreter Executionconfidence: HIGH
Arbitrary code execution is achieved by abusing the NMAP feature after database modification.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: HIGH
Low-privileged authenticated user escalates to full system compromise via the database-to-RCE path.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2022-37024Same product: Zohocorp Manageengine Netflow Analyzer
CVE-2023-47211Same product: Zohocorp Manageengine Netflow Analyzer
CVE-2024-5466Same product: Zohocorp Manageengine Opmanager
CVE-2023-31099Same product: Zohocorp Manageengine Opmanager
CVE-2019-17602Same product: Zohocorp Manageengine Opmanager
CVE-2021-20078Same product: Zohocorp Manageengine Opmanager
CVE-2023-29505Same product: Zohocorp Manageengine Network Configuration Manager
CVE-2021-40493Same product: Zohocorp Manageengine Opmanager
CVE-2019-12196Same product: Zohocorp Manageengine Netflow Analyzer
CVE-2021-41081Same product: Zohocorp Manageengine Network Configuration Manager

Affected Assets

zohocorp
manageengine netflow analyzer
12.5, 12.6
zohocorp
manageengine network configuration manager
12.5, 12.6
zohocorp
manageengine opmanager
12.5, 12.6
zohocorp
manageengine opmanager msp
12.5, 12.6
zohocorp
manageengine opmanager plus
12.5, 12.6
zohocorp
manageengine oputils
12.5, 12.6

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
  • CM-5 Access Restrictions for Change
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces authorization rules so that even authenticated low-privileged users cannot perform the unauthorized database modifications that trigger NMAP RCE.

AC-6 Least Privilege good match
prevent

Limits privileges of authenticated accounts to the minimum required, eliminating the ability to alter database entries that lead to code execution.

CM-5 Access Restrictions for Change partial match
prevent

Restricts which users or roles may perform configuration or data changes, blocking the specific database-modification path used in this CVE.

References