{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-08-08T18:06:16.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://manageengine.com"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.horizon3.ai/red-team-blog-cve-2022-28219/"}, {"tags": ["x_refsource_MISC"], "url": "http://cewolf.sourceforge.net/new/index.html"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.com/files/167997/ManageEngine-ADAudit-Plus-Path-Traversal-XML-Injection.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2022-28219", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://manageengine.com", "refsource": "MISC", "url": "https://manageengine.com"}, {"name": "https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html", "refsource": "CONFIRM", "url": "https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html"}, {"name": "https://www.horizon3.ai/red-team-blog-cve-2022-28219/", "refsource": "MISC", "url": "https://www.horizon3.ai/red-team-blog-cve-2022-28219/"}, {"name": "http://cewolf.sourceforge.net/new/index.html", "refsource": "MISC", "url": "http://cewolf.sourceforge.net/new/index.html"}, {"name": "http://packetstormsecurity.com/files/167997/ManageEngine-ADAudit-Plus-Path-Traversal-XML-Injection.html", "refsource": "MISC", "url": "http://packetstormsecurity.com/files/167997/ManageEngine-ADAudit-Plus-Path-Traversal-XML-Injection.html"}]}}, "x_gcve": [{"vulnId": "CVE-2022-28219", "recordType": "advisory"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T05:48:37.498Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://manageengine.com"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.horizon3.ai/red-team-blog-cve-2022-28219/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://cewolf.sourceforge.net/new/index.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.com/files/167997/ManageEngine-ADAudit-Plus-Path-Traversal-XML-Injection.html"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2022-28219", "datePublished": "2022-04-05T18:32:21.000Z", "dateReserved": "2022-03-30T00:00:00.000Z", "dateUpdated": "2024-08-03T05:48:37.498Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2022-28219", "date": "2026-11-08", "epss": "0.97009", "percentile": "0.99891"}, "nvd": "{\"cve\":{\"id\":\"CVE-2022-28219\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2022-04-05T19:15:08.360\",\"lastModified\":\"2026-06-17T04:38:10.603\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.\"},{\"lang\":\"es\",\"value\":\"Cewolf en Zoho ManageEngine ADAudit Plus antes de 7060 es vulnerable a un ataque XXE no autenticado que conduce a la ejecuci\u00f3n remota de c\u00f3digo\"}],\"affected\":[{\"source\":\"cve@mitre.org\",\"affectedData\":[{\"vendor\":\"n/a\",\"product\":\"n/a\",\"versions\":[{\"version\":\"n/a\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-611\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"6.0\",\"matchCriteriaId\":\"9CA0AE32-C300-46C3-9C2F-0B6F855FE42A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7000:*:*:*:*:*:*\",\"matchCriteriaId\":\"16BADE82-3652-4074-BDFF-828B7213CAF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7002:*:*:*:*:*:*\",\"matchCriteriaId\":\"01E9CAE9-4B45-4E7A-BE78-6E7E9A3A04E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7003:*:*:*:*:*:*\",\"matchCriteriaId\":\"CFA4FC59-CC4F-4F21-9AE9-3F526C91411C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7004:*:*:*:*:*:*\",\"matchCriteriaId\":\"26A6F6D1-540C-43C5-96A7-0E36F3E0A4D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7005:*:*:*:*:*:*\",\"matchCriteriaId\":\"97EA9324-9377-46E1-A0EA-637128E65DED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7006:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA5BE36E-A73A-4D1C-8185-9692373F1444\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7007:*:*:*:*:*:*\",\"matchCriteriaId\":\"10F48951-44A1-42C1-AE2A-B2CDFFCAFDBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7008:*:*:*:*:*:*\",\"matchCriteriaId\":\"F505C783-09DE-4045-9DB4-DD850B449A48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7050:*:*:*:*:*:*\",\"matchCriteriaId\":\"212BF664-02DE-457F-91A6-6F824ECC963B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7051:*:*:*:*:*:*\",\"matchCriteriaId\":\"D102B74F-6762-4EFE-BAF7-A7D416867D9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7052:*:*:*:*:*:*\",\"matchCriteriaId\":\"FEDF5C01-41D8-45C0-8F0D-3A7FCB6DADEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7053:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D6ACBF5-25C6-403A-BCFA-66A90A8B4E14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zohocorp:manageengine_adaudit_plus:7.0:7054:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF50DCAC-33E1-4FE2-BF3C-C6A17CC8E48A\"}]}]}],\"references\":[{\"url\":\"http://cewolf.sourceforge.net/new/index.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Product\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/167997/ManageEngine-ADAudit-Plus-Path-Traversal-XML-Injection.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://manageengine.com\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.horizon3.ai/red-team-blog-cve-2022-28219/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://cewolf.sourceforge.net/new/index.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Product\",\"Third Party Advisory\"]},{\"url\":\"http://packetstormsecurity.com/files/167997/ManageEngine-ADAudit-Plus-Path-Traversal-XML-Injection.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://manageengine.com\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.horizon3.ai/red-team-blog-cve-2022-28219/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}", "redhat_vex": {"current_release_date": "2026-03-27T12:33:37+00:00", "cve": "CVE-2022-28219", "id": "CVE-2022-28219", "initial_release_date": "2022-01-01T00:00:00+00:00", "product_status:known_not_affected": "1", "source": "Red Hat CSAF VEX", "status": "final", "title": "CVE-2022-28219", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-28219.json", "version": "3"}}}