Zoho ManageEngine CVE-2022-47966 (unauthenticated remote code execution via old Apache Santuario xmlsec in SAML SSO, CISA KEV, advisory AA23-250A): which ManageEngine products and builds are affected and what's the fix?

What it is: CVE-2022-47966 affects about two dozen on-premises Zoho ManageEngine products that shipped an outdated Apache Santuario (XML Security for Java) 1.4.1 library. In products where SAML single sign-on is or was configured, an unauthenticated attacker could run code on the server. Fixes came out in late October and November 2022, attacks started in January 2023, and CISA's joint advisory AA23-250A described nation-state actors using it (with a Fortinet flaw) against an aerospace organization. It's in CISA's Known Exploited Vulnerabilities catalog. ManageEngine servers often hold domain admin or privileged credentials, so a compromise reaches far. Am I affected: - You run an on-prem ManageEngine product at or below the impacted build in ManageEngine's advisory, for example ServiceDesk Plus 14003 and below (fixed 14004), ADSelfService Plus 6210 and below (fixed 6211), Endpoint Central 10.1.2228.10 and below (fixed 10.1.2228.11), Password Manager Pro 12123 and below (fixed 12124), PAM 360 5712 and below (fixed 5713). The advisory lists every product. - And SAML SSO is enabled now, or (for some products) was ever enabled. - Check the build number in the product's About page and compare with the advisory table. Fix: 1. Upgrade to the fixed build or, better, the current release of each product. Builds that old are far behind on other fixes too. 2. If SAML SSO was ever enabled on an unpatched build exposed to untrusted networks, assume compromise is possible: hunt using the indicators in AA23-250A (unexpected processes spawned by the ManageEngine service, new accounts, unusual outbound connections), and rebuild the server if anything is found. 3. Rotate credentials the product stores or uses (service accounts, domain accounts, privileged passwords in vaults like Password Manager Pro / PAM 360). 4. Don't expose ManageEngine admin portals to the internet; put them behind a VPN or allow-list. Verify: each product's About page shows a build at or above the fixed version, and the hunt finds nothing unexplained. Sources: https://www.manageengine.com/security/advisory/CVE/cve-2022-47966.html https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a https://nvd.nist.gov/vuln/detail/CVE-2022-47966