Hi there,

The security advisory addresses an unauthenticated remote code execution vulnerability identified in ManageEngine Password Manager Pro.

Severity: Critical

CVE-2022-35405

Given the severity of this vulnerability, we strongly urge all customers to install the latest build of Password Manager Pro. 

The complete fix for this is now available in the below version,

Issue:

This remote code execution vulnerability could allow remote attackers to execute arbitrary code on affected installations of Password Manager Pro. Authentication is not required to exploit this vulnerability.

For more details about the vulnerability, please visit: https://www.manageengine.com/products/passwordmanagerpro/advisory/rce.html

We have fixed this vulnerability by removing the vulnerable parser from Password Manager Pro.

What should customers do?

The latest version of Password Manager Pro holds the recommended mitigation targeting the vulnerability.  

Steps to Upgrade:

• Download the latest upgrade pack from https://www.manageengine.com/products/passwordmanagerpro/minor-upgrades.html

• Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Important note: We strongly recommend that you take a backup of your entire Password Manager Pro installation folder before the upgrade, and keep the copy in a separate location. This helps you prevent any accidental loss of data, and will keep all your settings intact. If you're using an MS SQL server as the back-end database, back up the Password Manager Pro database as well before upgrading. Once the upgrade is successfully completed, remember to delete the backup.

If you have any questions or concerns, please contact our product support at passwordmanagerpro support@manageengine.com.

We express our sincerest apologies for any inconvenience this may have caused.

Regards,