Log in Request a demo

Vulnerability Advisories Archive.

Entries 13Range June 2022 to July 2023

This page holds short security alerts about critical vulnerabilities in business software, firmware and network products. It covers 13 items from June 2022 to July 2023. Each entry keeps its first title, date and text. The newest come first, grouped by quarter. The old web addresses of these entries now lead to the matching entry here.

Jump to: 2023 Q3 | 2023 Q1 | 2022 Q4 | 2022 Q3 | 2022 Q2

All 13 entries

2023 Q3

Urgent Manual Fix Needed: Zimbra Collaboration Suite Under Attack Due To Actively Exploited Zero-Day Vulnerability

Published:

Zimbra is a widely used email and teamwork platform. It urges administrators to fix a zero-day vulnerability by hand. Attacks now target Zimbra Collaboration Suite (ZCS) email servers with it. Over 200,000 firms in 140 countries use the venue, including over 1,000 government and financial firms. This security flaw puts them at high risk.

A company advisory came out on Thursday. It says the security vulnerability in Zimbra Collaboration Suite Version 8.8.15 could harm the privacy and integrity of users’ data. The bug is a reflected Cross-Site Scripting (XSS) vulnerability. Clément Lecigne of Google’s Threat Analysis Group found and reported it. In XSS attacks, threat actors could steal private user data or run harmful code on vulnerable systems.

.@_clem1 discovered this being used in-the-wild in a targeted attack. Thank you to @Zimbra for publishing this advisory and mitigation advice! If you run Zimbra Collaboration Suite, please go manually apply the fix! #itw0days Zimbra security post on X.

— Maddie Stone (@maddiestone) July 13, 2023.

How Do You Do Manual Patch for Zimbra?

Zimbra has not yet given official security patches for the actively exploited zero-day. It has given a manual fix that admins can apply to remove the possible attack vector.

  • Take a backup of the file located at /opt/zimbra/jetty/webapps/zimbra/m/momoveto.
  • Open the file for editing and navigate to line number 40.
  • Update the value of the parameter to <input name=”st” type=”hidden” value=”${fn:escapeXml(param.st)}”/>.
  • Prior to the update, the line appeared as <input name=”st” type=”hidden” value=”${param.st}”/>.
  • The escapeXml() function now cleans user input. It escapes special characters used in XML markup. This stops cross-site scripting (XSS) vulnerabilities.

The escapeXml() function cleans user input by escaping special characters used in XML markup. This stops XSS attacks.

Admins should focus on this fix, given Zimbra’s history of being targeted.

Notably, in June 2022, Zimbra auths bypass, and remote code execution bugs were exploited. They breached over 1,000 servers. Later, in September 2022, unpatched RCE vulnerabilities in Zimbra Collaboration Suite were abused. This compromised nearly 900 servers within two months.

Most recently, the Russian hacking group Winter Vivern exploited another XSS bug in February 2023 to breach webmail portals of NATO-aligned governments. It stole email mailboxes from officials, governments, military staff, and diplomats.

2023 Q1

Apache Fineract Has Three Critical SQL Injection Vulnerabilities | CVE-2023-25196

Published:

Three critical vulnerabilities have been discovered in Apache Fineract. It is a platform built to bring the world’s unbanked people into the modern financial system. These vulnerabilities are CVE-2023-25195, CVE-2023-25196, and CVE-2023-25197, which could let unauthorized users reach private data or take control of the system.

The first vulnerability, CVE-2023-25197, is a SQL injection vulnerability. It comes from a failure to stop special characters used in SQL commands. This vulnerability could have a limited impact on specific parts of Apache Fineract. It affects versions 1.4 through 1.8.2.

The Severity of CVE-2023-25196 is Important

CVE-2023-25196, also a SQL injection vulnerability, is more severe than the first. Authorized users could use it to change or add data in specific Apache Fineract parts. This vulnerability affects versions 1.4 through 1.8.2.

The third vulnerability, CVE-2023-25195, involves a server-side request forgery (SSRF) issue in Apache Fineract. It could let authorized users reach the server and use it for outbound traffic. This vulnerability affects versions 1.4 through 1.8.3.

What is Apache Fineract?

Apache Fineract is an open-source, community-driven software platform for financial services. It serves underbanked and unbanked people. It is flexible. It can be adapted to the needs of financial institutions, microfinance institutions, and other firms that give financial services.

It has features to manage financial products and services, such as loans, savings, and insurance. It also has tools to manage customer data, track transactions, and make reports.

One of the critical goals of Apache Fineract is to promote financial inclusion. It makes financial services easier to reach. It also makes them cheaper for underserved communities around the world. The platform also adapts easily to different financial rules and links with other financial systems. This makes it a useful tool.

Firms in many regions and economies can use it. It matters most where traditional banking is weak or missing.

Financial inclusion is critical for economic growth and poverty reduction. Apache Fineract helps close the gap. It gives firms the tools to offer financial services to people who may not have had access to them. This can help promote entrepreneurship, create jobs, and raise financial stability in these communities.

A community of volunteers from around the world builds and maintains Apache Fineract. It is released under the Apache License, Version 2.0. This license lets anyone use, change, and share the software freely, with certain conditions.

Apache Fineract Solved the Vulnerabilities and Released the New Versions

To reduce these vulnerabilities, users should take these steps:

  • Upgrade to Apache Fineract 1.8.3 or higher, which includes fixes for all three vulnerabilities.
  • Apply the right security patches to the system.
  • Enable input validation and SQL escaping to prevent SQL injection attacks.
  • Configure the system to restrict access to internal resources and disable SSRF.

Firms must keep their software up to date. They should apply patches as soon as they come out. By staying alert and fixing vulnerabilities early, firms can keep this new platform running well.

How Can Brandefense Help You Against Vulnerabilities?

Vulnerability intelligence tells you about known vulnerabilities in software and systems. It covers the risk level, the affected products, and what people say about them on social media. Official references point to any patches or workarounds. Firms use it to find and rank the most harmful vulnerabilities in their internal and outside systems. They also use it to plan how to reduce the danger.

Brandefense is a digital risk protection solution that works ahead of attackers. Our AI-driven technology scans the dark, deep, and surface web all the time. It finds unknown events. It ranks risks on its own. It gives you intelligence you can act on at once. With it, you can find and rank the vulnerabilities in your systems. You can also plan how to reduce those risks.

Brandefense Vulnerability Intelligence Watch the vulnerabilities, rank them and act early Discover the Solution.

Hackers Are Targeting Organizations With FortiOS Vulnerability Exploitation

Published:

FortiOS Vulnerability Allows Hackers to Take Down Firewall Devices

FortiOS Vulnerability Exploited by Hackers in Targeted Attacks Against Governments and Large Companies.

Hackers exploit a severe vulnerability, CVE-2022-41328, in FortiOS. Governments and large firms widely use this operating system. The flaw lets them run arbitrary code. It has already caused data loss and system corruption in targeted firms. The vulnerability affects some versions of FortiOS, but the fix is available in the latest updates. Fortinet, the vendor, is closely monitoring the situation.

Understanding the seriousness of this FortiOS vulnerability is critical!

Hackers have already used it to breach government systems. They have also breached the systems of large firms. A recent report from Fortinet says threat actors hacked and took down many FortiGate firewall devices of one of its clients. They used CVE-2022-41328 exploits. The flaw’s advisory did not say that the vulnerability had been exploited before patches were available.

According to Bleepingcomputer, threat actors are using a critical FortiOS vulnerability to launch attacks against government agencies and large-scale firms. These attacks are causing data loss, operating systems, and file corruption in the targeted firms’ inventory.

“Don’t fall prey to cybercrime! The FortiOS vulnerability is no joke – hackers have already exploited it to breach top government and company systems. Stay informed and stay secure!”

Firms must update their FortiOS installations to the latest version as soon as possible. This avoids falling victim to this vulnerability. Firms should also review their security policies. Proper security measures should be in place to reduce the risk of cyber attacks. Examples are firewalls, intrusion detection and prevention systems, and network segmentation.

Routine security reviews and vulnerability scans help firms find and fix possible security issues. They do so before harmful actors exploit them. Firms can also hire third-party security experts. These experts run penetration tests and other security reviews to find any vulnerabilities in their systems. These steps help firms guard against the rising threat of cyber-attacks. They also protect private data and systems from unauthorized access and data breaches.

The vulnerability can lead to arbitrary code execution in vulnerable systems.

 CVE-2022-41328, is a path traversal vulnerability. The vulnerability arises from an authentication error while processing a specific CLI command. It affects the following FortiOS versions:

  • 6.0.
  • 6.2.
  • 6.4.0 – 6.4.11.
  • 7.0.0 – 7.0.9.
  • 7.2.0 – 7.2.3.

The updates that address the vulnerability are available in versions:

  • 6.4.12.
  • 7.0.10.
  • 7.2.4.

Threat Actors Manipulating Firmware to Gain Control of FortiGate Devices

The attacks were first seen when many FortiGate devices of a customer suddenly stopped working. They hit a boot error. 

They found that the devices had stopped with the following error message: “System enters error mode due to FIPS error: Firmware Integrity self-test failed.” FIPS-enabled devices verify the integrity of system parts. If a breach of integrity is found, the device shuts down. It rejects the boot to protect network integrity.

Don't Let Vulnerabilities Take Down Your Systems – Try Our Vulnerability Intelligence Solution Today! Request a Brandefense demo.

FORTINET investigations showed that threat actors changed the /sbin/init part in the device’s firmware image. They added a new file named /bin/fgfm as the first stage of the attack chain. This change lets /bin/fgfm run before normal startup actions. It gives an attacker continued access and control. Further stages of the attack involved running harmful code on the targeted systems.

Fortinet keeps watching the threat actors linked to this attack. To avoid similar attacks on firms’ inventories, keep the internal inventory on the latest version, where vulnerabilities are fixed. Watching network traffic and logs often can also help detect harmful activity quickly.

To prevent further damage, users of FortiOS must update their systems at once. Routine network traffic and logs monitoring can help find any suspicious actions early. Taking these precautions will help protect against future attacks and protect the integrity of your systems.

Be aware of this critical FortiOS vulnerability. It has been used in attacks on government institutions and large-scale firms. It caused data loss and corruption. Firms using FortiOS should update their systems to the latest versions at once. This reduces the risk of being hit by this vulnerability.

Routine network traffic and logs monitoring can also help quickly detect harmful activity. These steps can help prevent attacks on internal inventory and protect network integrity.

Fortinet Releases Critical Updates For FortiOS, FortiNAC And More

Published:

Fortinet has released security updates to address 40 security vulnerabilities hitting its FortiWeb, FortiOS, FortiNAC, and FortiProxy tools. Two of the 40 vulnerabilities found are considered critical, and 15 have a high level of importance.

Two of Fortinet’s Vulnerabilities are 9.8/10 Score

The critical vulnerabilities include CVE-2022-39952, a remote code execution (RCE) vulnerability in FortiNAC’s keyUpload script. Unauthenticated threat actors could use crafted HTTP requests to run unauthorized code or commands.

The affected versions include FortiNAC 9.4.0, FortiNAC 9.2.0 – 9.2.5, FortiNAC 9.1.0 – 9.1.7, and these:

  • FortiNAC 8.8 all versions.
  • FortiNAC 8.7 all versions.
  • FortiNAC 8.6 all versions.
  • FortiNAC 8.5 all versions.
  • FortiNAC 8.3 all versions.

The second critical vulnerability, CVE-2021-42756, affects FortiWeb Proxy. It is caused by a stack-based buffer overflow vulnerability. This vulnerability lets an unauthenticated, remote threat actor use crafted HTTP requests. This would run arbitrary code on vulnerable systems. The affected versions include FortiWeb 5. x all versions, FortiWeb 6.0.7 and below, and FortiWeb 6.1.2 and below.

They also include FortiWeb 6.2.6 and below, FortiWeb 6.3.16 and below, and all versions of FortiWeb 6.4.

Fortinet has also released security updates for other vulnerabilities. They hit these products:

  • FortiADC.
  • FortiExtender.
  • FortiOS.
  • FortiProxy.
  • FortiSwitchManager.
  • FortiWAN.
  • FortiAnalyzer.
  • FortiAuthenticator.
  • FortiPortal.
  • FortiSandbox.

Users are advised to apply the updates promptly to avoid possible attacks abusing these vulnerabilities.

Critical Vulnerabilities On Lenovo ThinkPad X13s BIOS

Published:

Security vulnerabilities have been found in the BIOS software of Lenovo ThinkPad X13s model devices. They may let threat actors run code remotely on the affected system. They may also let them reach private data of the local user. (Reference Link).

The details of the vulnerabilities are as follows:

The vulnerabilities tracked as CVE-2022-40516, CVE-2022-40517, and CVE-2022-40520, are stack-based buffer overflow security vulnerabilities. A local threat actor with elevated privileges could use them to cause memory corruption in the Qualcomm BIOS.

The vulnerabilities, tracked as CVE-2022-40518 and CVE-2022-40519 in the Qualcomm BIOS, allow a local threat actor with elevated privileges to access memory contents.

The vulnerabilities tracked as CVE-2022-4432, CVE-2022-4433, CVE-2022-4434, and CVE-2022-4435, are in the ThinkPad X13s BIOS. They allow a local threat actor with elevated privileges to access memory contents.

These vulnerabilities affect versions before ThinkPad X13s BIOS 1.47. To avoid attacks that abuse vulnerabilities, upgrade to current versions that fix the vulnerability.

2022 Q4

Critical RCE Alarm In FortiOS Sslvpnd

Published:

A critical security vulnerability has been detected in FortiOS’s SSL-VPN (sslvpnd) that could allow threat actors to remote code execution (RCE) on affected installations.

The security vulnerability, tracked as CVE-2022-42475, is caused by a Heap-based Buffer Overflow hitting the sslvpnd daemon part. An unauthenticated, remote threat actor can manipulate the SSL-VPN part through crafted data. This triggers a stack-based buffer overflow and runs arbitrary code on the targeted system. Fortinet states that this vulnerability is actively exploited. It recommends that users check their systems for the following indicators of compromise.

If the following log string is observed more than once in user systems, check the items below.

  • Logdesc=”Application Crashed” And Msg=”[…] Application:sslvpnd,[…], Signal 11 Received, Backtrace: […].

If the existence of the following structures is detected in the file system, check the items below.

  • /Data/Lib/Libips.Bak.
  • /Data/Lib/Libgif.So.
  • /Data/Lib/Libiptcp.So.
  • /Data/Lib/Libipudp.So.
  • /Data/Lib/Libjepg.So.
  • /Var/.Sslvpnconfigbk.
  • /Data/Etc/Wxd.Conf.
  • /Flash.

If connections are made from FortiGate to the following suspicious IP addresses:

  • 34.130.40:444.
  • 131.189.143:30080,30081,30443,20443.
  • 36.119.61:8443,444.
  • 247.168.153:8033.

Threat actors actively exploit the vulnerability. To avoid attacks that abuse vulnerabilities, install the published updates at once. Also block the specified indicators (IoC) in the security tools in use.

Multiple Vulnerabilities Detected In IT Management Solution GLPI

Published:

Many security vulnerabilities have been found in GLPI. It is an open-source web application. It helps institutions/firms and firms manage their IT infrastructure and inventories. These vulnerabilities let threat actors run SQL queries against the application database. They can also carry out Cross-Site Scripting (XSS) and Server-Side Request Forgery (SSRF) attacks.

The details of the detected security vulnerabilities are as follows.

  • The security vulnerability tracked as CVE-2022-39375 is due to weak cleaning of user-supplied entries in the RSS Feed function. A remote threat actor can use a harmful link to run arbitrary HTML code and script in the user’s browser. This happens in the context of the vulnerable website. Successful use of this vulnerability lets remote threat actors get private data. They can also alter the web page’s appearance and carry out phishing attacks.
  • The security vulnerability tracked as CVE-2022-39234 is due to insufficient session expiry time. This vulnerability lets threat actors reach users’ accounts by reusing old session credentials (Cookies). This may lead to the capture of users’ private data.
  • The security vulnerability tracked as CVE-2022-39323 is due to weak cleaning of user-supplied data in the API REST user_token part. A remote threat actor can send a crafted request to the affected application. This runs arbitrary SQL commands in the application database.
  • The security vulnerability, tracked as CVE-2022-39276, is due to weak checks of user-supplied inputs in RSS feeds. A remote threat actor can send a crafted HTTP request. It directs the application to start requests to arbitrary systems (SSRF).
  • The vulnerability security, tracked as CVE-2022-39277, is due to weak cleaning of user-supplied data on outside connections. A remote threat actor can run arbitrary HTML code and script in the user’s browser. This happens in the context of the vulnerable website, via a crafted link.

These vulnerabilities affect specific versions of GLPI. Security updates have been released that fix the vulnerabilities. Upgrade vulnerable installations to the current versions at once. This avoids attacks that abuse vulnerabilities.

Critical RCE Vulnerabilities Affecting F5 Products Detected

Published:

Application service provider F5 has issued a security notice for two critical security vulnerabilities that allow an unauthenticated threat actor with network access to use remote code execution in BIG-IP systems. BIG-IP is a mix of software and hardware built around access control, application availability, and security tools.

F5, in its statement, said the security vulnerabilities were found in the representative state transfer (REST) interface. This interface is part of the iControl framework, which F5 devices and users use to communicate.

The found security vulnerabilities are:

The vulnerability, code CVE-2022-41622, is caused by cross-site request forgery (CSRF). It affects BIG-IP and BIG-IQ products. This allows threat actors to gain root access to a device’s management interface.

The vulnerability code CVE-2022-41800 allows a threat actor with administrative privileges to run code remotely on vulnerable systems via an RPM file.

BIG-IP product versions affected by these security vulnerabilities are as follows.

  • 1.0 – 16.1.2.
  • 1.0 – 15.1.5.
  • 1.0 – 14.1.4.
  • 1.0 – 13.1.4.
  • 1.0 – 12.1.6.
  • 6.1 – 11.6.5.

Updates will not be released for 11. x (11.6.1 – 11.6.5) and 12. x (12.1.0 – 12.1.6) versions. F5 said there is no data that security vulnerabilities have been exploited yet. It said existing updates will be included in future versions as soon as possible. To avoid targeted attacks that abuse the vulnerability, install the published updates at once.

Critical UEFI Firmware Vulnerabilities Detected In Specific Lenovo Notebook Models

Published:

Lenovo has released updates about vulnerabilities detected in the UEFI Firmware component hitting Yoga, IdeaPad, and ThinkBook devices. UEFI is software that acts as an interface between the operating system and the firmware in the device’s hardware. It starts the operating system when a device is powered on. So, UEFI offers an attractive attack surface for threat actors who want to release malware that is hard to detect and remove.

Threat actors could use these vulnerabilities to disable Secure Boot. Secure Boot is a security method that stops harmful programs from loading during the boot process. Here are the details:

  • The vulnerability, tracked as CVE-2022-3430, affects the WMI Setup driver on certain Lenovo Notebook PC devices. It allows a threat actor with elevated privileges to modify Secure Boot settings by modifying an NVRAM variable.
  • The vulnerability, tracked as CVE-2022-3431, affects a driver used in certain Lenovo Notebook PC devices. The driver is not accidentally disabled during the manufacturing process. A threat actor with elevated privileges could change the Secure Boot setting by changing an NVRAM variable.
  • The vulnerability, tracked as CVE-2022-3432, affects a driver used during the manufacturing process on the IdeaPad Y700-14ISK. The driver was not accidentally disabled. A threat actor with elevated privileges could alter the Secure Boot setting by changing an NVRAM variable.

After the Eset security researcher detected the vulnerabilities, Lenovo announced that it took action to fix the vulnerabilities. But Lenovo has stated that it does not plan to release fixes for CVE-2022-3432 as the affected model has reached the end of life (EoL). Users of other affected devices should update their firmware to the latest version. This avoids attacks that abuse vulnerabilities.

Multiple Vulnerabilities Detected In Juniper Networks Junos OS

Published:

Many critical security vulnerabilities have been found in Junos OS. It is a network operating system used in security and network devices built by Juniper Networks. The vulnerabilities let threat actors carry out unauthorized file access, cross-site scripting (XSS), and directory traversal attacks.

Some of the detected security vulnerabilities are as follows:

  • The security vulnerability, tracked as CVE-2022-22241, is due to incorrect login validation hitting the J-Web part of Juniper Networks Junos OS. As a result, an unauthenticated threat actor can exploit the vulnerability. The actor can then gain access to data through a crafted POST request without proper authorization.
  • The vulnerability, tracked as CVE-2022-22246, is a PHP Local File Inclusion (LFI) vulnerability. It affects the J-Web part of Juniper Networks Junos OS. A low-privileged authenticated threat actor could run a harmful PHP file on the vulnerable system.
  • The vulnerability tracked as CVE-2022-22242 is a Cross-Site Scripting (XSS) vulnerability. It affects the J-Web part of Juniper Networks Junos OS. An unauthenticated threat actor could run harmful scripts in the user’s browser in the context of a J-Web session.
  • The vulnerability tracked as CVE-2022-22244 is an XPath Injection vulnerability. It affects the J-Web part of Juniper Networks Junos OS. An unauthenticated threat actor can exploit the vulnerability through a crafted POST request.

These vulnerabilities, which affect all versions of the Junos operating system, are critically rated as high and have been fixed with the updates released by Juniper Networks. To avoid attacks that abuse vulnerabilities, vulnerable Junos OS users should upgrade at once to released updates. As a workaround, they can disable J-Web or restrict access to trusted hosts only.

2022 Q3

Critical 0-Day Alarm In Microsoft Exchange Server

Published:

Two new 0-day vulnerabilities have been found hitting Microsoft Exchange Server 2013, 2016, and 2019 products.

The details of the vulnerabilities are as follows:

  • The first critical security vulnerability (SSRF), tracked as CVE-2022-41040, is due to weak checks of user-supplied input in the Exchange OWA interface. A remote threat actor can send a crafted HTTP request. It directs the application to start requests to arbitrary systems.
  • Another security vulnerability tracked as CVE-2022-41082 is due to incorrect login validation in the Exchange Server. A remote user can run arbitrary code on the system. The user needs access to PowerShell Remoting on Exchange systems affected by security vulnerability.

It is observed that threat actors exploit these vulnerabilities in targeted attacks. The attacks detailed by Microsoft show that the two vulnerabilities are used together in an exploit chain. The SSRF vulnerability allows an authenticated threat actor to run arbitrary code. But abusing the vulnerabilities requires authenticated access to vulnerable Exchange Servers.

Microsoft has announced that Exchange Online users are not affected by these vulnerabilities. It has released a set of workarounds to reduce possible threats to affected customers. To avoid targeted attacks that abuse vulnerabilities, set up the following workarounds from Microsoft at once. Also check often for new updates.

  • IIS Manager should open.
  • The Default Web Site bar should be expanded.
  • The Autodiscover tab should open.
  • The URL Rewrite feature within the IIS framework should be clicked.
  • In the Actions pane on the right, the Add Rule(s) option should open.
  • Select the Request Blocking option and click OK.
  • In the Add Request Rule window that opens, add the string “.*autodiscover\.json.*\@.*Powershell.*” to the URL Pattern section and click OK.
  • The added rule should be selected, and the Edit feature in the Conditions frame on the side tab should be opened.
  • Should change the condition entry from {URL} to {REQUEST_URI}.

Critical Vulnerabilities Affecting 1000+ Organizations Detected In FileWave MDM Solution

Published:

Critical security vulnerabilities hitting more than a thousand firms have been found in the MDM (Mobile Device Management) solution of FileWave. FileWave provides device management tools and is based in Switzerland. IoT tools are in wide use. The use of device management tools from FileWave is increasing daily. The tools make it easy for IT administrators to manage all of a firm’s devices well.

  • The security vulnerability, tracked as CVE-2022-34907, is due to an Authentication Bypass bug. The bug hits FileWave MDM versions before 14.6.3 and 14.7.x. This allows threat actors to circumvent authentication methods in the vulnerable system.
  • A second vulnerability, tracked as CVE-2022-34906, is due to the presence of a hard-coded encryption key. The key is found in FileWave MDM versions before 14.6.3 and 14.7.x.

By abusing the vulnerabilities, threat actors can capture critical data in the affected installations. They can also run arbitrary code on the system. Threat actors can use CVE-2022-34907 to hijack all managed devices. They can also leak private data, such as:

  • device serial numbers.
  • user email addresses.
  • geolocation coordinates.
  • IP addresses.
  • device PINs, and more.

Vulnerable MDM installations are known to compromise the security of more than 1000 firms. FileWave has fixed security vulnerabilities with a recent update (14.8). Institutions/firms or firms using vulnerable MDM tools should apply the published security updates at once. This avoids attacks that abuse vulnerabilities.

2022 Q2

[Exploit Details]: Critical RCE Vulnerability Found In ManageEngine ADAudit Plus

Published:

In March 2022, an unauthenticated remote code execution (RCE) vulnerability was found hitting the Zoho ManageEngine ADAudit Plus solution. Firms use it to monitor changes in Active Directory. (Reference Link).

The security vulnerability tracked as CVE-2022-28219 is caused by a combination of Untrusted Java Deserialization, Path Traversal, and XEE (XML External Entity) issues. The vulnerability allows remote code execution on affected systems. In some cases, it can also be exploited to compromise domain administrator accounts.

Active Directory management-related products (ADManager Plus, ADSelfService Plus, ADAudit Plus) are widely used by institutions/firms.

These apps create an attractive attack surface for threat actors. They have privileged access to Active Directory. Security experts have published details of the PoC code and apps for abusing the vulnerability hitting ADAudit Plus.

Apps such as ADAudit Plus integrate with Active Directory. They must store credentials to connect to it. ADAudit Plus keeps these credentials encrypted in its database. It is possible to reverse the encryption for clear access to these credentials. If these credentials are hacked, it gives a lot of privilege to the threat actors.

ADAudit Plus makes it easy for users to connect to AD with their domain administrator credentials. Users use this easy way instead of creating a special service account with limited privileges. By manipulating this feature, threat actors can completely compromise the AD domain through ADAudit Plus.

To avoid attacks that abuse the vulnerability, institutions/firms using ADAudit Plus should upgrade urgently. They should move to ADAudit Plus 7060 or a later version. This fixes the security vulnerability.

Know What Is Exposed. Before Attackers Do.

Book a demo of the platform.

  • 4.7Gartner Peer Insights
  • 24hEarly warning time
  • 190+Countries covered

What you see in the demo

  1. Your exposureAssets and services seen from the outside, starting from your own domain.
  2. Threats aimed at youLeaked credentials, look-alike domains and brand abuse in one view.
  3. From alert to actionHow findings reach your team and what to do next.