var-202208-0895
Vulnerability from variot
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution. Zoho Corporation of ManageEngine Firewall Analyzer and ManageEngine NetFlow Analyzer Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine OpManager. Authentication is required to exploit this vulnerability.The specific flaw exists within the getDNSResolveOption function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. ZOHO ManageEngine OpManager etc. are all products of ZOHO India. ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software. ZOHO ManageEngine OpManager Plus is an IT operations management solution for Windows and Linux systems. ZOHO ManageEngine OpManager MSP is an easy-to-use network and server management software
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202208-0895",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "manageengine opmanager msp",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.6"
},
{
"model": "manageengine network configuration manager",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.6"
},
{
"model": "manageengine opmanager msp",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.5"
},
{
"model": "manageengine oputils",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.6"
},
{
"model": "manageengine netflow analyzer",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.5"
},
{
"model": "manageengine firewall analyzer",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.5"
},
{
"model": "manageengine opmanager plus",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.5"
},
{
"model": "manageengine netflow analyzer",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.6"
},
{
"model": "manageengine opmanager plus",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.6"
},
{
"model": "manageengine opmanager",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.5"
},
{
"model": "manageengine firewall analyzer",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.6"
},
{
"model": "manageengine opmanager",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.6"
},
{
"model": "manageengine network configuration manager",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.5"
},
{
"model": "manageengine oputils",
"scope": "eq",
"trust": 1.0,
"vendor": "zohocorp",
"version": "12.5"
},
{
"model": "manageengine netflow analyzer",
"scope": null,
"trust": 0.8,
"vendor": "zoho",
"version": null
},
{
"model": "manageengine firewall analyzer",
"scope": null,
"trust": 0.8,
"vendor": "zoho",
"version": null
},
{
"model": "opmanager plus",
"scope": null,
"trust": 0.7,
"vendor": "manageengine",
"version": null
},
{
"model": "netflow analyzer",
"scope": null,
"trust": 0.7,
"vendor": "manageengine",
"version": null
},
{
"model": "opmanager",
"scope": null,
"trust": 0.7,
"vendor": "manageengine",
"version": null
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1184"
},
{
"db": "ZDI",
"id": "ZDI-22-1183"
},
{
"db": "ZDI",
"id": "ZDI-22-1179"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014728"
},
{
"db": "NVD",
"id": "CVE-2022-37024"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Anonymous",
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1184"
},
{
"db": "ZDI",
"id": "ZDI-22-1183"
},
{
"db": "ZDI",
"id": "ZDI-22-1179"
}
],
"trust": 2.1
},
"cve": "CVE-2022-37024",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "ZDI",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.2,
"id": "CVE-2022-37024",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 2.1,
"userInteraction": "NONE",
"vectorString": "AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2022-37024",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2022-37024",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "ZDI",
"id": "CVE-2022-37024",
"trust": 2.1,
"value": "HIGH"
},
{
"author": "nvd@nist.gov",
"id": "CVE-2022-37024",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2022-37024",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202208-2746",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1184"
},
{
"db": "ZDI",
"id": "ZDI-22-1183"
},
{
"db": "ZDI",
"id": "ZDI-22-1179"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014728"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-2746"
},
{
"db": "NVD",
"id": "CVE-2022-37024"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code execution. Zoho Corporation of ManageEngine Firewall Analyzer and ManageEngine NetFlow Analyzer Exists in unspecified vulnerabilities.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine OpManager. Authentication is required to exploit this vulnerability.The specific flaw exists within the getDNSResolveOption function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. ZOHO ManageEngine OpManager etc. are all products of ZOHO India. ZOHO ManageEngine OpManager is a set of network, server and virtualization monitoring software. ZOHO ManageEngine OpManager Plus is an IT operations management solution for Windows and Linux systems. ZOHO ManageEngine OpManager MSP is an easy-to-use network and server management software",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-37024"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014728"
},
{
"db": "ZDI",
"id": "ZDI-22-1184"
},
{
"db": "ZDI",
"id": "ZDI-22-1183"
},
{
"db": "ZDI",
"id": "ZDI-22-1179"
},
{
"db": "VULHUB",
"id": "VHN-427595"
},
{
"db": "VULMON",
"id": "CVE-2022-37024"
}
],
"trust": 3.69
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-37024",
"trust": 5.5
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014728",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-17695",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-22-1184",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-17697",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-22-1183",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-17696",
"trust": 0.7
},
{
"db": "ZDI",
"id": "ZDI-22-1179",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-202208-2746",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-427595",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2022-37024",
"trust": 0.1
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1184"
},
{
"db": "ZDI",
"id": "ZDI-22-1183"
},
{
"db": "ZDI",
"id": "ZDI-22-1179"
},
{
"db": "VULHUB",
"id": "VHN-427595"
},
{
"db": "VULMON",
"id": "CVE-2022-37024"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014728"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-2746"
},
{
"db": "NVD",
"id": "CVE-2022-37024"
}
]
},
"id": "VAR-202208-0895",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-427595"
}
],
"trust": 0.01
},
"last_update_date": "2024-08-14T15:06:14.234000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ManageEngine has issued an update to correct this vulnerability.",
"trust": 2.1,
"url": "https://www.manageengine.com/itom/advisory/cve-2022-37024.html"
},
{
"title": "Multiple ZOHO ManageEngine Product security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=204577"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1184"
},
{
"db": "ZDI",
"id": "ZDI-22-1183"
},
{
"db": "ZDI",
"id": "ZDI-22-1179"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-2746"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "Lack of information (CWE-noinfo) [NVD evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-014728"
},
{
"db": "NVD",
"id": "CVE-2022-37024"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.7,
"url": "https://www.manageengine.com/itom/advisory/cve-2022-37024.html"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-37024"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-37024/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-22-1184"
},
{
"db": "ZDI",
"id": "ZDI-22-1183"
},
{
"db": "ZDI",
"id": "ZDI-22-1179"
},
{
"db": "VULHUB",
"id": "VHN-427595"
},
{
"db": "VULMON",
"id": "CVE-2022-37024"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014728"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-2746"
},
{
"db": "NVD",
"id": "CVE-2022-37024"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "ZDI",
"id": "ZDI-22-1184"
},
{
"db": "ZDI",
"id": "ZDI-22-1183"
},
{
"db": "ZDI",
"id": "ZDI-22-1179"
},
{
"db": "VULHUB",
"id": "VHN-427595"
},
{
"db": "VULMON",
"id": "CVE-2022-37024"
},
{
"db": "JVNDB",
"id": "JVNDB-2022-014728"
},
{
"db": "CNNVD",
"id": "CNNVD-202208-2746"
},
{
"db": "NVD",
"id": "CVE-2022-37024"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-09-05T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1184"
},
{
"date": "2022-09-01T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1183"
},
{
"date": "2022-09-01T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1179"
},
{
"date": "2022-08-10T00:00:00",
"db": "VULHUB",
"id": "VHN-427595"
},
{
"date": "2022-08-10T00:00:00",
"db": "VULMON",
"id": "CVE-2022-37024"
},
{
"date": "2023-09-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2022-014728"
},
{
"date": "2022-08-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202208-2746"
},
{
"date": "2022-08-10T20:16:05.147000",
"db": "NVD",
"id": "CVE-2022-37024"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-09-05T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1184"
},
{
"date": "2022-09-01T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1183"
},
{
"date": "2022-09-01T00:00:00",
"db": "ZDI",
"id": "ZDI-22-1179"
},
{
"date": "2022-08-16T00:00:00",
"db": "VULHUB",
"id": "VHN-427595"
},
{
"date": "2022-08-10T00:00:00",
"db": "VULMON",
"id": "CVE-2022-37024"
},
{
"date": "2023-09-21T08:08:00",
"db": "JVNDB",
"id": "JVNDB-2022-014728"
},
{
"date": "2022-08-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202208-2746"
},
{
"date": "2022-08-16T16:01:57.027000",
"db": "NVD",
"id": "CVE-2022-37024"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202208-2746"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Zoho\u00a0Corporation\u00a0 of \u00a0ManageEngine\u00a0Firewall\u00a0Analyzer\u00a0 and \u00a0ManageEngine\u00a0NetFlow\u00a0Analyzer\u00a0 Vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2022-014728"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202208-2746"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.