Descripción
Zoho ManageEngine ADSelfService Plus contains an unspecified vulnerability allowing for remote code execution when performing a password change or reset.
Acción recomendada
Aplicar las actualizaciones según las instrucciones del fabricante.
Referencias
- Aviso de manageengine.com manageengine.com/products/self-service-password/advisory/CVE-2022-288…
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2022-28810
Otras vulnerabilidades de Zoho en el catálogo
- CVE-2022-47966 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Alta 23-01-2023
- CVE-2022-35405 Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability Alta 22-09-2022
- CVE-2021-44515 Zoho Desktop Central Authentication Bypass Vulnerability Alta 10-12-2021
- CVE-2021-44077 Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability Alta 01-12-2021
- CVE-2021-37415 Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability Alta 01-12-2021