CVE:CVE-2022-47966
CNNVD:CNNVD-202301-1466
ZOHO ManageEngine ServiceDesk Plus（SDP）是美国卓豪（ZOHO）公司的一套基于ITIL架构的IT服务管理软件。该软件集成了事件管理、问题管理、资产管理IT项目管理、采购与合同管理等功能模块。
多款ZOHO ManageEngine产品存在安全漏洞，该漏洞源于产品中使用了 Apache xmlsec 1.4.1 版本，在这个版本没有提供安全保护，而 ManageEngine 应用程序也不提供这些保护。
solution:Upgrade zohocorp manageengine_access_manager_plus to a higher version than 4.3,4.3:build4300,4.3:build4301,4.3:build4302,4.3:build4303,4.3:build4304,4.3:build4305,4.3:build4306,4.3:build4307,and avoid the version (,4.3),4.3:build4300,4.3:build4301,4.3:build4302,4.3:build4303,4.3:build4304,4.3:build4305,4.3:build4306,4.3:build4307; Upgrade zohocorp manageengine_ad360 to a higher version than 4.3,4.3:4300,4.3:4302,4.3:4303,4.3:4304,4.3:4305,4.3:4306,4.3:4308,4.3:4309,and avoid the version (,4.3),4.3:4300,4.3:4302,4.3:4303,4.3:4304,4.3:4305,4.3:4306,4.3:4308,4.3:4309; Upgrade zohocorp manageengine_adaudit_plus to a higher version than 7.0,7.0:7000,7.0:7002,7.0:7003,7.0:7004,7.0:7005,7.0:7006,7.0:7007,7.0:7008,7.0:7050,7.0:7051,7.0:7052,7.0:7053,7.0:7054,7.0:7055,7.0:7060,7.0:7062,7.0:7063,7.0:7065,7.0:7080,and avoid the version (,7.0),7.0:7000,7.0:7002,7.0:7003,7.0:7004,7.0:7005,7.0:7006,7.0:7007,7.0:7008,7.0:7050,7.0:7051,7.0:7052,7.0:7053,7.0:7054,7.0:7055,7.0:7060,7.0:7062,7.0:7063,7.0:7065,7.0:7080; Upgrade zohocorp manageengine_admanager_plus to a higher version than 7.1,7.1:7100,7.1:7101,7.1:7102,7.1:7110,7.1:7111,7.1:7112,7.1:7113,7.1:7114,7.1:7115,7.1:7116,7.1:7117,7.1:7118,7.1:7120,7.1:7121,7.1:7122,7.1:7123,7.1:7124,7.1:7125,7.1:7126,7.1:7130,7.1:7131,7.1:7140,7.1:7141,7.1:7150,7.1:7151,7.1:7160,7.1:7161,and avoid the version (,7.1),7.1:7100,7.1:7101,7.1:7102,7.1:7110,7.1:7111,7.1:7112,7.1:7113,7.1:7114,7.1:7115,7.1:7116,7.1:7117,7.1:7118,7.1:7120,7.1:7121,7.1:7122,7.1:7123,7.1:7124,7.1:7125,7.1:7126,7.1:7130,7.1:7131,7.1:7140,7.1:7141,7.1:7150,7.1:7151,7.1:7160,7.1:7161; Upgrade zohocorp manageengine_adselfservice_plus to a higher version than 6.2,6.2:6200,6.2:6201,6.2:6202,6.2:6203,6.2:6204,6.2:6205,6.2:6206,6.2:6207,6.2:6208,6.2:6209,6.2:6210,and avoid the version (,6.2),6.2:6200,6.2:6201,6.2:6202,6.2:6203,6.2:6204,6.2:6205,6.2:6206,6.2:6207,6.2:6208,6.2:6209,6.2:6210; Upgrade zohocorp manageengine_analytics_plus to a higher version than 5.1,5.1:5100,5.1:5110,5.1:5120,5.1:5121,5.1:5130,5.1:5140,and avoid the version (,5.1),5.1:5100,5.1:5110,5.1:5120,5.1:5121,5.1:5130,5.1:5140; Upgrade zohocorp manageengine_assetexplorer to a higher version than 6.9,6.9:6900,6.9:6901,6.9:6902,6.9:6903,6.9:6904,6.9:6905,6.9:6906,6.9:6907,6.9:6908,6.9:6909,6.9:6950,6.9:6951,6.9:6952,6.9:6953,6.9:6954,6.9:6955,6.9:6956,6.9:6957,6.9:6970,6.9:6971,6.9:6972,6.9:6973,6.9:6974,6.9:6975,6.9:6976,6.9:6977,6.9:6978,6.9:6979,6.9:6980,6.9:6981,6.9:6982,and avoid the version (,6.9),6.9:6900,6.9:6901,6.9:6902,6.9:6903,6.9:6904,6.9:6905,6.9:6906,6.9:6907,6.9:6908,6.9:6909,6.9:6950,6.9:6951,6.9:6952,6.9:6953,6.9:6954,6.9:6955,6.9:6956,6.9:6957,6.9:6970,6.9:6971,6.9:6972,6.9:6973,6.9:6974,6.9:6975,6.9:6976,6.9:6977,6.9:6978,6.9:6979,6.9:6980,6.9:6981,6.9:6982; Upgrade zohocorp manageengine_key_manager_plus to a higher version than 6.4,6.4:6400,and avoid the version (,6.4),6.4:6400; Upgrade zohocorp manageengine_pam360 to a higher version than 5.7,5.7:build5700,5.7:build5710,5.7:build5711,5.7:build5712,and avoid the version (,5.7),5.7:build5700,5.7:build5710,5.7:build5711,5.7:build5712; Upgrade zohocorp manageengine_password_manager_pro to a higher version than 12.1,12.1:build12100,12.1:build12101,12.1:build12110,12.1:build12120,12.1:build12121,12.1:build12122,12.1:build12123,and avoid the version (,12.1),12.1:build12100,12.1:build12101,12.1:build12110,12.1:build12120,12.1:build12121,12.1:build12122,12.1:build12123; Upgrade zohocorp manageengine_servicedesk_plus to a higher version than 14.0,14.0:14000,14.0:14001,14.0:14002,14.0:14003,and avoid the version (,14.0),14.0:14000,14.0:14001,14.0:14002,14.0:14003; Upgrade zohocorp manageengine_servicedesk_plus_msp to a higher version than 13.0,13.0:13000,and avoid the version (,13.0),13.0:13000; Upgrade zohocorp manageengine_supportcenter_plus to a higher version than 11.0:11017,11.0:11018,11.0:11019,11.0:11020,11.0:11021,11.0:11022,11.0:11024,11.0:11025,and avoid the version 11.0:11017,11.0:11018,11.0:11019,11.0:11020,11.0:11021,11.0:11022,11.0:11024,11.0:11025; Upgrade zohocorp application_control_plus to a higher version than 10.1.220.17,and avoid the version (,10.1.220.17]; Upgrade zohocorp manageengine_browser_security_plus to a higher version than 11.1.2238.5,and avoid the version (,11.1.2238.5]; Upgrade zohocorp manageengine_desktop_central to a higher version than 10.1.2228.10,and avoid the version (,10.1.2228.10]; Upgrade zohocorp manageengine_device_control_plus to a higher version than 10.1.2220.17,and avoid the version (,10.1.2220.17]; Upgrade zohocorp manageengine_endpoint_dlp_plus to a higher version than 10.1.2137.5,and avoid the version (,10.1.2137.5]; Upgrade zohocorp manageengine_os_deployer to a higher version than 1.1.2243.0,and avoid the version (,1.1.2243.0]; Upgrade zohocorp manageengine_patch_manager_plus to a higher version than 10.1.2220.17,and avoid the version (,10.1.2220.17]; Upgrade zohocorp manageengine_remote_access_plus to a higher version than 10.1.2228.10,and avoid the version (,10.1.2228.10]; Upgrade zohocorp manageengine_rmm_central to a higher version than 10.1.40,and avoid the version (,10.1.40]; Upgrade zohocorp manageengine_vulnerability_manager_plus to a higher version than 10.1.2220.17,and avoid the version (,10.1.2220.17]