CVE-2022-35405

Published: Jul 19, 2022Modified: Oct 31, 2025CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)

Affected (8)

Products: Zohocorp: Manageengine Access Manager Plus, Manageengine Pam360, Manageengine Password Manager Pro

Zohocorp

3 products

Manageengine Access Manager Plus

Manageengine Pam360

Manageengine Password Manager Pro

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Access Manager Plus	Before 4.3
Zohocorp Manageengine Access Manager Plus	Version 4.3 build4300
Zohocorp Manageengine Access Manager Plus	Version 4.3 build4301
Zohocorp Manageengine Access Manager Plus	Version 4.3 build4302
Zohocorp Manageengine Pam360	Before 5.5
Zohocorp Manageengine Pam360	Version 5.5 build5500
Zohocorp Manageengine Password Manager Pro	Before 12.1
Zohocorp Manageengine Password Manager Pro	Version 12.1 build12100