high7.5
CVE-2022-36923
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 t…
Impact
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zohocorp | Manageengine Firewall Analyzer | Versions 12.5, 12.6 |
| Zohocorp | Manageengine Netflow Analyzer | Versions 12.5, 12.6 |
| Zohocorp | Manageengine Network Configuration Manager | Versions 12.5, 12.6 |
| Zohocorp | Manageengine Opmanager | Versions 12.5, 12.6 |
| Zohocorp | Manageengine Opmanager Msp | Versions 12.5, 12.6 |
| Zohocorp | Manageengine Opmanager Plus | Versions 12.5, 12.6 |
| Zohocorp | Manageengine Oputils | Versions 12.5, 12.6 |