Hi there,

This security advisory is to let you know that a high severity vulnerability was detected in ManageEngine Password Manager Pro.

What is the issue?

An SQL Injection vulnerability(CVE-2022-47523) was discovered in Password Manager Pro. We have fixed this issue by adding proper validation and escaping special characters.

Version details

Severity: High

Impact:

This vulnerability can allow an adversary to execute custom queries, and access the database table entries using the vulnerable request.

For more details about this vulnerability, please click here.

What should customers do?

Given the severity of this vulnerability, customers are strongly advised to upgrade to the latest build of Password Manager Pro immediately.

Steps to Upgrade:

1. Download the latest upgrade pack from here.

2. Apply the latest build to your existing product installation as per the upgrade pack instructions provided in the above links.

Please contact our support team for further details at the below mentioned email address:

passwordmanagerpro-support@manageengine.com

Important note: We strongly recommend that you take a backup of your entire Password Manager Pro installation folder before the upgrade, and keep the copy in a separate location. This helps you prevent any accidental loss of data, and will keep all your settings intact. If you're using an MS SQL server as the back-end database, backup the product database as well before upgrading. Once the upgrade is successfully completed, remember to delete the backup.

Please ignore this mail if you have installed the latest build of Password Manager Pro. We express our sincerest apologies for any inconvenience this may have caused.

Regards,

Team ManageEngine