CVE-2022-27908

HIGH

8.8

CVSS Score

Published: April 18, 2022 at 12:17 PM UTC

Updated: June 17, 2026 at 04:37 AM UTC

1 product affected across 1 vendorManageengine Opmanager

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.8

Exploit prediction

EPSS 36%

Description

Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Manageengine Opmanager · Zohocorp

95%

v < 12.512.5 12.5 build125000 12.5 build125002 12.5 build125100 12.5 build125101 12.5 build125102 12.5 build125108 12.5 build125110 12.5 build125111 12.5 build125112 12.5 build125113 12.5 build125114 12.5 build125116 12.5 build125117 12.5 build125118 12.5 build125120 12.5 build125121 12.5 build125123 12.5 build125124 12.5 build125125 12.5 build125136 12.5 build125137 12.5 build125139 12.5 build125140 12.5 build125143 12.5 build125144 12.5 build125145 12.5 build125156 12.5 build125157 12.5 build125158 12.5 build125159 12.5 build125161 12.5 build125163 12.5 build125174 12.5 build125175 12.5 build125176 12.5 build125177 12.5 build125178 12.5 build125180 12.5 build125181 12.5 build125192 12.5 build125193 12.5 build125194 12.5 build125195 12.5 build125196 12.5 build125197 12.5 build125198 12.5 build125201 12.5 build125204 12.5 build125212 12.5 build125213 12.5 build125214 12.5 build125215 12.5 build125216 12.5 build125228 12.5 build125229 12.5 build125230 12.5 build125231 12.5 build125232 12.5 build125233 12.5 build125312 12.5 build125323 12.5 build125324 12.5 build125326 12.5 build125328 12.5 build125329 12.5 build125340 12.5 build125341 12.5 build125342 12.5 build125343 12.5 build125344 12.5 build125346 12.5 build125358 12.5 build125359 12.5 build125360 12.5 build125361 12.5 build125362 12.5 build125364 12.5 build125366 12.5 build125367 12.5 build125375 12.5 build125376 12.5 build125377 12.5 build125378 12.5 build125379 12.5 build125380 12.5 build125381 12.5 build125382 12.5 build125386 12.5 build125392 12.5 build125393 12.5 build125394 12.5 build125397 12.5 build125398 12.5 build125399 12.5 build125405 12.5 build125410 12.5 build125411 12.5 build125413 12.5 build125414 12.5 build125415 12.5 build125416 12.5 build125417 12.5 build125420 12.5 build125428 12.5 build125430 12.5 build125431 12.5 build125432 12.5 build125433 12.5 build125434 12.5 build125437 12.5 build125446 12.5 build125448 12.5 build125450 12.5 build125451 12.5 build125452 12.5 build125453 12.5 build125455 12.5 build125466 12.5 build125467 12.5 build125468 12.5 build125469 12.5 build125470 12.5 build125482 12.5 build125483 12.5 build125485 12.5 build125486 12.5 build125487 12.5 build125488 12.5 build125489 12.5 build125567 12.5 build125568 12.5 build125587 12.5 build125588 12.5 build125589

Affected range stops below 12.5, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.manageengine.com/network-monitoring/security-updates/cve-2022-27908.html

References (1)

x_refsource_MISCPatchVendor Advisory

Source: [email protected]

https://www.manageengine.com/network-monitoring/security-updates/cve-2022-27908.html

CVSS

8.8HIGH[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-89

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card