CVE-2022-28219: XEE
Published Apr 5, 2022
·Updated
Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.
Affected Software
14 affected components
ZohoCorp ManageEngine ADAudit Plus<=6.0
ZohoCorp ManageEngine ADAudit Plus=7.0-7000
ZohoCorp ManageEngine ADAudit Plus=7.0-7002
ZohoCorp ManageEngine ADAudit Plus=7.0-7003
ZohoCorp ManageEngine ADAudit Plus=7.0-7004
ZohoCorp ManageEngine ADAudit Plus=7.0-7005
ZohoCorp ManageEngine ADAudit Plus=7.0-7006
ZohoCorp ManageEngine ADAudit Plus=7.0-7007
ZohoCorp ManageEngine ADAudit Plus=7.0-7008
ZohoCorp ManageEngine ADAudit Plus=7.0-7050
ZohoCorp ManageEngine ADAudit Plus=7.0-7051
ZohoCorp ManageEngine ADAudit Plus=7.0-7052
ZohoCorp ManageEngine ADAudit Plus=7.0-7053
ZohoCorp ManageEngine ADAudit Plus=7.0-7054
Remediation
Event History
Apr 5, 2022
CVE Published
via MITRE·06:32 PM
Data Sourced
via MITRE·06:32 PM
Description
Frequently Asked Questions
1
What is CVE-2022-28219?
CVE-2022-28219 is a vulnerability in Cewolf in Zoho ManageEngine ADAudit Plus that allows an unauthenticated XXE attack leading to remote code execution.
2
What is the severity of CVE-2022-28219?
CVE-2022-28219 has a severity rating of 9.8, which is considered critical.
3
How can the vulnerability in CVE-2022-28219 be exploited?
The vulnerability in CVE-2022-28219 can be exploited through an unauthenticated XXE attack.
4
What is the affected software?
The affected software is Zoho ManageEngine ADAudit Plus versions up to 6.0 and versions 7.0-7000 to 7.0-7054.
5
How can I fix the vulnerability in CVE-2022-28219?
To fix the vulnerability in CVE-2022-28219, it is recommended to update Zoho ManageEngine ADAudit Plus to version 7.0-7060 or later.