What’s Vulnerable › Vulnerabilities

CVE-2022-29081

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 83.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-28 · updated 2026-06-17
• Weakness: CWE-22

Description

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize) via the ../RestAPI substring.

Affected products

• Zohocorp ManageEngine Access Manager Plus: 4.0-build4000, 4.1-build4100, 4.1-build4101, 4.2-build4200, 4.2-build4201, 4.2-build4202 (+3)
• Zohocorp ManageEngine PAM360: 4.0-build4001, 4.0-build4002, 4.1-build4100, 4.1-build4101, 4.5-build4500, 4.5-build4501 (+11)
• Zohocorp ManageEngine Password Manager Pro: 10.1-build10103, 10.1-build10104, 10.2-build10200, 10.3-build10300, 10.3-build10301, 10.3-build10302 (+18)

References

• https://www.manageengine.com/privileged-session-management/advisory/cve-2022-29081.html
• https://www.tenable.com/security/research/tra-2022-14
• https://www.manageengine.com/privileged-session-management/advisory/cve-2022-29081.html
• https://www.tenable.com/security/research/tra-2022-14

Get alerted when CVE-2022-29081 or the next vulnerability affects your stack