CVE-2022-29457
HIGH
8.8
CVSS Score
Published: April 18, 2022 at 07:47 PM UTC
Updated: June 17, 2026 at 04:40 AM UTC
4 products affected across 1 vendorManageEngine ADSelfService PlusManageengine Adaudit PlusManageEngine ADManager Plus
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.8
Exploit prediction
EPSS 8%
Description
Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certain storage-path configuration steps.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < 7.0.07.0.07.0.0 70007.0.0 70027.0.0 70037.0.0 70047.0.0 70057.0.0 70067.0.0 70077.0.0 70087.0.0 70507.0.0 70517.0.0 70527.0.0 70537.0.0 70547.0.0 7055
Affected range stops below 7.0.0, so it looks safe — our inference, not a vendor statement
v < 7.17.17.1 71007.1 71017.1 71027.1 71107.1 71117.1 71127.1 71137.1 71147.1 71157.1 71167.1 71177.1 71187.1 71207.1 71217.1 71227.1 71237.1 71247.1 71257.1 71267.1 7130
Affected range stops below 7.1, so it looks safe — our inference, not a vendor statement
v < 6.16.16.1 61006.1 61016.1 61026.1 61036.1 61046.1 61056.1 61066.1 61076.1 61086.1 61096.1 61106.1 61116.1 61126.1 61136.1 61146.1 61156.1 61166.1 61176.1 61186.1 61196.1 6120
Affected range stops below 6.1, so it looks safe — our inference, not a vendor statement
Affected range stops below 5.7, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (3)
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
Source: [email protected]
http://packetstormsecurity.com/files/167051/ManageEngine-ADSelfService-Plus-Build-6118-NTLMv2-Hash-Exposure.htmlx_refsource_MISCExploitPatchThird Party Advisory
Source: [email protected]
https://docs.unsafe-inline.com/0day/multiple-manageengine-applications-critical-information-disclosure-vulnerabilityx_refsource_MISCRelease NotesVendor Advisory
Source: [email protected]
https://www.manageengine.com/products/self-service-password/release-notes.htmlCVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-522
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card