ManageEngine security advisory—Important security fix released for Password Manager Pro

ManageEngine security advisory—Important security fix released for Password Manager Pro

Hi there,

 

The security advisory addresses multiple SQL Injection vulnerabilities (CVE-2022-40300) identified in ManageEngine Password Manager Pro.

 

Severity: High

 

Given the severity of this issue, we strongly urge all customers to install the latest build of Password Manager Pro.

The complete fix for this is now available in the below version,

 

Product Name

Affected Version(s)

Fixed Version(s)

Fixed On

Password Manager Pro

12120 and below

12121

10-09-2022

 

Issue:

These vulnerabilities can allow an adversary to execute custom queries and access the database table entries using the vulnerable request.

 

We have fixed this issue by adding proper validation and escaping special characters on the server side.

 

For further details and updates, please visit: https://www.manageengine.com/products/passwordmanagerpro/advisory/cve-2022-40300.html

 

What should customers do?

The latest version of Password Manager Pro holds the recommended mitigation targeting the vulnerabilities.  

 

Steps to Upgrade:

  • Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links. 

Important note: We strongly recommend that you take a backup of your entire Password Manager Pro installation folder before the upgrade, and keep the copy in a separate location. This helps you prevent any accidental loss of data, and will keep all your settings intact. If you're using an MS SQL server as the back-end database, back up the Password Manager Pro database as well before upgrading. Once the upgrade is successfully completed, remember to delete the backup.

 

If you have any questions or concerns, please contact our product support at passwordmanagerpro-support@manageengine.com.

We express our sincerest apologies for any inconvenience this may have caused.

 

Regards,

Team ManageEngine

      New to ADSelfService Plus?

        Resources

                  Related Products