CVE-2022-29081

Summary

CVE-2022-29081 is a vulnerability affecting Zoho ManageEngine Access Manager Plus versions before 4302, Password Manager Pro versions before 12007, and PAM360 versions before 5401. The issue involves an access-control bypass on certain Rest API URLs, specifically SSOutAction, SSLAction, LicenseMgr, GetProductDetails, GetDashboard, FetchEvents, and Synchronize. An attacker can exploit this vulnerability by manipulating the ../RestAPI substring to gain unauthorized access. This may result in sensitive data exposure or unauthorized system modifications. Organizations using these affected versions are advised to apply the necessary patches promptly to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.