Zoho is urging its customers to urgently fix a dangerous security flaw that exists in several ManageEngine products.
See also: CircleCI issued a security breach warning
A critical security flaw, known as CVE-2022-47523, has been identified in the company's Password Manager Pro secure vault, PAM360 privileged access management program, and Access Manager Plus privileged session management solution. The vulnerability is a dangerous SQL injection that could potentially compromise user data stored on these systems.
If attackers manage to exploit the system, they would be able to gain access to the backend database without requiring authentication. This would allow them to create and execute custom queries, which could allow them to view entries in various database tables.
The organization stressed that, due to the potentially harmful nature of this vulnerability, customers should hurry to upgrade to the latest version of PAM360, Password Manager Pro, and Access Manager Plus.
Last month, Zoho took action to address the issue, validating and properly securing the special characters.
To update your product, download the latest update package for PAM360, Password Manager Pro, or Access Manager Plus. Upgrading will ensure you have access to all the features and functionality available in the newest version!
See also: New Linux malware installs cryptominers, DDoS bots
The next step is to deploy the latest version according to the upgrade instructions available on upgrade package .
Last September, CISA warned enterprises about a critical security vulnerability (CVE-2022-35405) in ManageEngine, which could be used to gain remote code execution on unpatched servers running PAM360, Access Manager Plus, and Password Manager Pro.
In recent years, Zoho ManageEngine servers have been subject to numerous attacks (especially Desktop Central instances) and access data has been sold on underground hacking forums.
Zoho provides small and medium-sized businesses with a range of enterprise-grade business applications designed to meet their specific needs. This includes everything from customer relationship management (CRM) software to accounting tools, communication solutions, project management solutions, email marketing solutions, analytics tools, billing solutions, employee scheduling solutions, and more. All of these applications are accessible via the cloud, making them accessible from anywhere and easy to use.
Information source: bleepingcomputer.com
