ManageEngine security advisory—Important security fix released for ManageEngine Access Manager Plus

ManageEngine security advisory—Important security fix released for ManageEngine Access Manager Plus

Hi there,

 

The security advisory addresses a authenticated remote code execution vulnerability identified ManageEngine Access Manager Plus.

 

Severity: Critical

CVE-2022-35405‚Äč

 

Given the severity of this vulnerability, we strongly urge all customers to install the latest build of Access Manager Plus

The complete fix for this is now available in the below versions,

 

Product Name

Affected Version(s)

Fixed Version(s)

Fixed On

Access Manager Plus

4302 and below

4303

24-06-2022

 

Issue:

 

This remote code execution vulnerability could allow remote attackers to execute arbitrary code on affected installations of Access Manager Plus.

 

For more details about the vulnerability, please visit: https://www.manageengine.com/products/passwordmanagerpro/advisory/rce.html

 

We have fixed this vulnerability by removing the vulnerable components from Access Manager Plus.

 

What should customers do?

The latest version of Access Manager Plus holds the recommended mitigation targeting the vulnerability.  

 

Steps to Upgrade:

  • Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

 Important note: We strongly recommend that you take a backup of your entire Access Manager Plus installation folder before the upgrade, and keep the copy in a separate location. This helps you prevent any accidental loss of data, and will keep all your settings intact. If you're using an MS SQL server as the back-end database, back up the Access Manager Plus database as well before upgrading. Once the upgrade is successfully completed, remember to delete the backup.

 

If you have any questions or concerns, please contact our product support accessmanagerplus-support@manageengine.com.

We express our sincerest apologies for any inconvenience this may have caused.

 

Regards,

Team ManageEngine

      New to ADSelfService Plus?

        Resources

                  Related Products