CVE-2022-43672

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 67.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-12 · updated 2026-06-17
Weakness: CWE-89

Description

Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671.

Affected products

Zohocorp ManageEngine Access Manager Plus: before 4.3; 4.3-build4300, 4.3-build4301, 4.3-build4302, 4.3-build4303, 4.3-build4304, 4.3-build4305 — fixed in 4.3
Zohocorp ManageEngine PAM360: before 5.7; 5.7-build5700, 5.7-build5710 — fixed in 5.7
Zohocorp ManageEngine Password Manager Pro: before 12.1; 12.1-build12100, 12.1-build12101, 12.1-build12110, 12.1-build12120, 12.1-build12121 — fixed in 12.1

How to fix

Upgrade to a fixed version: Zohocorp ManageEngine Access Manager Plus 4.3; Zohocorp ManageEngine PAM360 5.7; Zohocorp ManageEngine Password Manager Pro 12.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-43672 or the next vulnerability affects your stack