What’s Vulnerable › Vulnerabilities

CVE-2022-29457

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-18 · updated 2026-06-17
• Weakness: CWE-522

Description

Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.

Affected products

• ManageEngine ADAudit Plus: before 7.0.0; 7.0.0, 7.0.0-7000, 7.0.0-7002, 7.0.0-7003, 7.0.0-7004, 7.0.0-7005 (+9) — fixed in 7.0.0
• Zohocorp ManageEngine ADManager Plus: before 7.1; 7.1, 7.1-7100, 7.1-7101, 7.1-7102, 7.1-7110, 7.1-7111 (+15) — fixed in 7.1
• ManageEngine ADSelfService Plus: before 6.1; 6.1, 6.1-6100, 6.1-6101, 6.1-6102, 6.1-6103, 6.1-6104 (+16) — fixed in 6.1
• Zohocorp ManageEngine Exchange Reporter Plus: before 5.7; 5.7, 5.7-5700 — fixed in 5.7

How to fix

Upgrade to a fixed version: ManageEngine ADAudit Plus 7.0.0; Zohocorp ManageEngine ADManager Plus 7.1; ManageEngine ADSelfService Plus 6.1; Zohocorp ManageEngine Exchange Reporter Plus 5.7. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/167051/ManageEngine-ADSelfService-Plus-Build-6118-NTLMv2-Hash-Exposure.html
• https://docs.unsafe-inline.com/0day/multiple-manageengine-applications-critical-information-disclosure-vulnerability
• https://www.manageengine.com/products/self-service-password/release-notes.html
• http://packetstormsecurity.com/files/167051/ManageEngine-ADSelfService-Plus-Build-6118-NTLMv2-Hash-Exposure.html
• https://docs.unsafe-inline.com/0day/multiple-manageengine-applications-critical-information-disclosure-vulnerability
• https://www.manageengine.com/products/self-service-password/release-notes.html

Get alerted when CVE-2022-29457 or the next vulnerability affects your stack