Fix CVE

rapid7 · Jan 30, 2023 · f676568 · f676568
1 parent e01239c
commit f676568
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/...s/exploit/multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966.md b/...s/exploit/multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966.md
@@ -2,7 +2,7 @@
 
 This exploits an unauthenticated remote code execution vulnerability that
 affects Zoho ManageEngine ADSelfService Plus versions 6210 and below
-(CVE-2020-0646). Due to a dependency to an outdated library (Apache Santuario
+(CVE-2022-47966). Due to a dependency to an outdated library (Apache Santuario
 version 1.4.1), it is possible to execute arbitrary code by providing a crafted
 `samlResponse` XML to the ADSelfService Plus SAML endpoint. Note that the target
 is only vulnerable if it has been configured with SAML-based SSO at least once

diff --git a/modules/exploits/multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966.rb b/modules/exploits/multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966.rb
@@ -17,7 +17,7 @@ def initialize(info = {})
         'Description' => %q{
           This exploits an unauthenticated remote code execution vulnerability
           that affects Zoho ManageEngine AdSelfService Plus versions 6210 and
-          below (CVE-2020-0646). Due to a dependency to an outdated library
+          below (CVE-2022-47966). Due to a dependency to an outdated library
           (Apache Santuario version 1.4.1), it is possible to execute arbitrary
           code by providing a crafted `samlResponse` XML to the ADSelfService Plus
           SAML endpoint. Note that the target is only vulnerable if it has been
@@ -31,7 +31,7 @@ def initialize(info = {})
         ],
         'License' => MSF_LICENSE,
         'References' => [
-          ['CVE', '2020-0646'],
+          ['CVE', '2022-47966'],
           ['URL', 'https://blog.viettelcybersecurity.com/saml-show-stopper/'],
           ['URL', 'https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/'],
           ['URL', 'https://github.com/horizon3ai/CVE-2022-47966'],