https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-40300.html

The remote host is running a version of ManageEngine Access Manager Plus prior to 4.3 Build 4305. It is, therefore, affected by a SQL injection vulnerability. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of arbitrary data.

The remote host is running a version of ManageEngine PAM360 prior to 5.6 Build 5600. It is, therefore, affected by a SQL injection vulnerability. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of arbitrary data.

The remote host is running a version of ManageEngine Password Manager Pro prior to 12.1 Build 12121. It is, therefore, affected by a SQL injection vulnerability. An unauthenticated, remote attacker can exploit this to inject or manipulate SQL queries in the back-end database, resulting in the disclosure or manipulation of arbitrary data.

ID	Name	Product	Family	Severity
165348	ManageEngine Access Manager Plus < 4.3 Build 4305 SQLi	Nessus	CGI abuses	critical
165347	ManageEngine PAM360 < 5.6 Build 5600 SQLi	Nessus	CGI abuses	critical
165346	ManageEngine Password Manager Pro < 12.1 Build 12121 SQLi	Nessus	CGI abuses	critical

CVE-2022-40300

critical

Tenable Plugins

critical

critical

critical