CVE-2022-28219 : Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthe

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.

Published 2022-04-05 19:15:08

Updated 2022-10-26 02:30:08

Source MITRE

View at NVD, CVE.org

Vulnerability category: XML external entity (XXE) injectionExecute code

Products affected by CVE-2022-28219

Zohocorp » Manageengine Adaudit Plus
Versions up to, including, (<=) 6.0
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7000
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7000:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7002
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7002:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7003
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7003:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7004
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7004:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7005
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7005:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7006
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7006:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7007
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7007:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7008
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7008:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7050
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7050:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7051
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7051:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7052
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7052:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7053
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7053:*:*:*:*:*:*
Matching versions
Zohocorp » Manageengine Adaudit Plus » Version: 7.0 Update 7054
cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7054:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2022-28219

EPSS FAQ

97.44%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2022-28219

ManageEngine ADAudit Plus CVE-2022-28219

Disclosure Date: 2022-06-29

First seen: 2022-12-23

exploit/windows/http/manageengine_adaudit_plus_cve_2022_28219

This module exploits CVE-2022-28219, which is a pair of vulnerabilities in ManageEngine ADAudit Plus versions before build 7060: a path traversal in the /cewolf endpoint, and a blind XXE in, to upload and execute an executable file. Authors: - Nave

More information

CVSS scores for CVE-2022-28219

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-28219

CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-28219

http://packetstormsecurity.com/files/167997/ManageEngine-ADAudit-Plus-Path-Traversal-XML-Injection.html

ManageEngine ADAudit Plus Path Traversal / XML Injection ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://cewolf.sourceforge.net/new/index.html

Cewolf - Chart Enabling Web Object Framework
Product;Third Party Advisory
https://www.horizon3.ai/red-team-blog-cve-2022-28219/

CVE-2022-28219: Unauthenticated XXE to RCE and Domain Compromise in ManageEngine ADAudit Plus – Horizon3.ai
Exploit;Third Party Advisory
https://manageengine.com

ManageEngine - IT Operations and Service Management Software
Vendor Advisory

CVEs referencing this url
https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html

Unauthenticated Remote Code Execution Vulnerability (CVE-2022-28219) fixed | ManageEngine ADAudit Plus
Patch;Vendor Advisory

Jump to