Zohocorp ManageEngine Key Manager Plus vulnerabilities

5 CVEs affecting Zohocorp ManageEngine Key Manager Plus, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-47966, published 2023-01-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-47966: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability, published 2023-01-18. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-01-23. EPSS: 99.8% chance of exploitation in the next 30 days. Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because…
CVE-2019-12133, published 2019-06-18. High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days. Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub-folders. Moreover, the services…
CVE-2021-28382, published 2021-06-07. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD.
CVE-2022-24446, published 2022-03-01. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the…
CVE-2022-24447, published 2022-03-02. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and…