CVE-2022-38772 Command injection in n/a

High 8.8 Published 29 Aug 2022 Updated 3 Aug 2024

Authenticated users can trigger remote code execution via the NMAP feature in Zoho ManageEngine network management products.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-38772?

CVE-2022-38772 is a high-severity command injection vulnerability in Zohocorp Manageengine Opmanager, published on 29 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.

Which versions are affected by CVE-2022-38772?

It affects 6 products.

Products include Zohocorp Manageengine Netflow Analyzer, Zohocorp Manageengine Network Configuration Manager, Zohocorp Manageengine Opmanager, Zohocorp Manageengine Opmanager Msp, Zohocorp Manageengine Opmanager Plus, Zohocorp Manageengine Oputils.

How do I fix CVE-2022-38772?

No fix has been published for CVE-2022-38772 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-38772 being exploited?

There is no known exploitation of CVE-2022-38772 in the wild and no public exploit code.

All Zohocorp Manageengine Opmanager vulnerabilities

Sources

Also known as GHSA-qhfj-p2m5-p6pg.