CVE-2022-28219

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://cewolf.sourceforge.net/new/index.htmlProduct, Third Party Advisory
http://packetstormsecurity.com/files/167997/ManageEngine-ADAudit-Plus-Path-Traversal-XML-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://manageengine.comVendor Advisory
https://www.horizon3.ai/red-team-blog-cve-2022-28219/Exploit, Third Party Advisory
https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.htmlPatch, Vendor Advisory
http://cewolf.sourceforge.net/new/index.htmlProduct, Third Party Advisory
http://packetstormsecurity.com/files/167997/ManageEngine-ADAudit-Plus-Path-Traversal-XML-Injection.htmlExploit, Third Party Advisory, VDB Entry
https://manageengine.comVendor Advisory
https://www.horizon3.ai/red-team-blog-cve-2022-28219/Exploit, Third Party Advisory
https://www.manageengine.com/products/active-directory-audit/cve-2022-28219.htmlPatch, Vendor Advisory

Timeline

Published: Apr 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-28227.5An attacker can freely brute force username and password and can takeover any account. An attacker could easily guess user passwords and gai CVE-2022-282207.5Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-202 CVE-2022-282216.1The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] paramet CVE-2022-282226.1The CleanTalk AntiSpam plugin <= 5.173 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] paramet CVE-2022-282237.2Tekon KIO devices through 2022-03-30 allow an authenticated admin user to escalate privileges to root by uploading a malicious Lua plugin.CVE-2022-282245.5Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with th CVE-2022-282257.8Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary CVE-2022-282267.8Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker to execute arbitary CVE-2022-282289.1Out-of-bounds read was discovered in YDB server. An attacker could construct a query with insert statement that would allow him to read sens CVE-2022-282297.5The hash functionality in userver before 42059b6319661583b3080cab9b595d4f8ac48128 allows attackers to cause a denial of service via crafted CVE-2022-28234.8The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parame CVE-2022-282307.8Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after