SQL Injection Vulnerability in Multiple ManageEngine Products (CVE-2022-47523)

On December 29, ManageEngine disclosed a high-severity SQL injection vulnerability in its Password Manager Pro, PAM360 and Access Manager Plus products. These three products have been targeted in the past by attackers and over the last three years, attackers have set their sights on a variety of ManageEngine products including DesktopCentral, ServiceDesk Plus, ADSelfService Plus.

For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog.