Read the docs
TI-2022-21434 Aliases CVE-2022-43671GHSA-hvv4-8q8q-fp7m

Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access…

Priority CRITICAL 88CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.

Summary

Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.7483 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:*:*:*:*:*:*:*:*before 4.3VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:*4.3 build4300VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:*4.3 build4301VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:*4.3 build4302VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4303:*:*:*:*:*:*4.3 build4303VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4304:*:*:*:*:*:*4.3 build4304VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4305:*:*:*:*:*:*4.3 build4305VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:*:*:*:*:*:*:*:*before 5.7VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.7:build5700:*:*:*:*:*:*5.7 build5700VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_pam360:5.7:build5710:*:*:*:*:*:*5.7 build5710VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:*:*:*:*:*:*:*:* Versions before 4.3 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4300:*:*:*:*:*:* Versions 4.3 build4300 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4301:*:*:*:*:*:* Versions 4.3 build4301 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4302:*:*:*:*:*:* Versions 4.3 build4302 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4303:*:*:*:*:*:* Versions 4.3 build4303 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4304:*:*:*:*:*:* Versions 4.3 build4304 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_access_manager_plus:4.3:build4305:*:*:*:*:*:* Versions 4.3 build4305 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:*:*:*:*:*:*:*:* Versions before 5.7 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.7:build5700:*:*:*:*:*:* Versions 5.7 build5700 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_pam360:5.7:build5710:*:*:*:*:*:* Versions 5.7 build5710 Vulnerable ·Zohocorp
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:*:*:*:*before 12.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12100:*:*:*:*:*:*12.1 build12100VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12101:*:*:*:*:*:*12.1 build12101VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12110:*:*:*:*:*:*12.1 build12110VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12120:*:*:*:*:*:*12.1 build12120VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12121:*:*:*:*:*:*12.1 build12121VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:*:*:*:*:*:*:*:* Versions before 12.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12100:*:*:*:*:*:* Versions 12.1 build12100 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12101:*:*:*:*:*:* Versions 12.1 build12101 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12110:*:*:*:*:*:* Versions 12.1 build12110 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12120:*:*:*:*:*:* Versions 12.1 build12120 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_password_manager_pro:12.1:build12121:*:*:*:*:*:* Versions 12.1 build12121 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43671
  2. 2026-10-03 Alias added: GHSA-hvv4-8q8q-fp7m

References

Advisory 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-15981 Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-19138 Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550… CVSS 3.1CRITICAL 9.8
  • TI-2022-23597 Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and… CVSS 3.1CRITICAL 9.8
  • TI-2022-21435 Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access… CVSS 3.1CRITICAL 9.8
  • TI-2022-11635 Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and… CVSS 3.1CRITICAL 9.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences