What’s Vulnerable › Vulnerabilities

CVE-2022-24446

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-01 · updated 2026-06-17

Description

An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the operator.

Affected products

• Zohocorp Manageengine Key Manager Plus: 6.1.6, 6.1.6-build6100, 6.1.6-build6150, 6.1.6-build6151, 6.1.6-build6160, 6.1.6-build6161

References

• https://cds.thalesgroup.com/en/tcs-cert/CVE-2022-24446
• https://excellium-services.com/cert-xlm-advisory/cve-2022-24446/
• https://www.manageengine.com/key-manager/release-notes.html#6200
• https://excellium-services.com/cert-xlm-advisory/cve-2022-24446/
• https://www.manageengine.com/key-manager/release-notes.html#6200

Get alerted when CVE-2022-24446 or the next vulnerability affects your stack