CVE-2022-36923

HIGH EXPLOITED NUCLEI

Zohocorp Manageengine Firewall Analyzer - Improper Access Control

Title source: rule

Description

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.

Nuclei Templates (1)

Zoho ManageEngine - getUserAPIKey Authentication Bypass

HIGHVERIFIEDby daffainfo,jjcho

References (1)

[Vendor Advisory] https://www.manageengine.com/itom/advisory/cve-2022-36923.html

Scores

CVSS v3 7.5

EPSS 0.3250

EPSS Percentile 96.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitation Intel

VulnCheck KEV 2023-11-17

Classification

CWE

CWE-755 CWE-284

Status published

Affected Products (50)

zohocorp/manageengine_firewall_analyzer

... and 35 more

Timeline

Published Aug 10, 2022

Tracked Since Feb 18, 2026