April 18, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – APT15 aka Playful Taurus – Active IOCs
January 20, 2023Rewterz Threat Alert – APT Group Gamaredon – Active IOCs
January 20, 2023Rewterz Threat Alert – APT15 aka Playful Taurus – Active IOCs
January 20, 2023Rewterz Threat Alert – APT Group Gamaredon – Active IOCs
January 20, 2023
Severity
High
Analysis Summary
CVE-2022-47966
Multiple ManageEngine products could allow a remote attacker to execute arbitrary code on the system, caused by the usage of an outdated third party dependency, Apache Santuario. If SAML single sign-on is currently or has been previously enabled on those products, an attacker could send a SAML request with an invalid signature to execute arbitrary code on the system.
Impact
- Code Execution
Indicators Of Compromise
CVE
- CVE-2022-47966
Affected Vendors
Zoho
Affected Products
- ManageEngine Access Manager Plus 4307
- ManageEngine Active Directory 360 4309
- ManageEngine ADAudit Plus 7080
- ManageEngine ADManager Plus 7161
- ManageEngine ADSelfService Plus 6210
Remediation
Refer to Fortinet Security Advisory for patch, upgrade or suggested workaround information.
