CVE-2022-47523

Critical

Published: 05 January 2023

Published

05 January 2023

Modified

09 April 2025

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.4555 97.7th percentile

Risk Priority 47 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-47523 is a critical-severity SQL Injection (CWE-89) vulnerability in Zohocorp Manageengine Access Manager Plus. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 2.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

Zoho ManageEngine Access Manager Plus before version 4309, Password Manager Pro before 12210, and PAM360 before 5801 contain a SQL injection vulnerability tracked as CVE-2022-47523. The issue is also associated with CWE-89 and CWE-79 and carries a CVSS 3.1 base score of 9.8 reflecting network attack vector, low complexity, and no required privileges or user interaction.

An unauthenticated remote attacker can supply crafted input to exploit the flaw and obtain full read, write, and disruption capabilities over the affected installation. The same vector may additionally enable cross-site scripting behavior consistent with the listed CWEs.

Vendor advisories published at https://www.manageengine.com/privileged-session-management/advisory/cve-2022-47523.html direct customers to apply the corrected releases (Access Manager Plus 4309, Password Manager Pro 12210, and PAM360 5801) to eliminate the injection paths. The associated EPSS score reached a peak of 0.5828 before receding to its current value of 0.4555.