CVE-2022-42904
Published: 18 November 2022
Summary
CVE-2022-42904 is a high-severity Command Injection (CWE-77) vulnerability in Zohocorp Manageengine Admanager Plus. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 0.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Zoho ManageEngine ADManager Plus through version 7151 contains a command injection vulnerability (CWE-77) that permits authenticated administrators to execute operating system commands via the proxy settings configuration. The flaw carries a CVSS 3.1 base score of 7.2 and affects the product's network-accessible administrative interface.
An attacker who already possesses valid administrative credentials and network reachability can supply crafted proxy values that result in arbitrary command execution. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability on the underlying host.
The vendor has published a knowledge-base article at https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2022-42904.html that addresses the issue. The EPSS score for this CVE has remained steady at approximately 0.79 since disclosure, indicating sustained but not newly emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-45962
Vulnerability details
Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.