CVEvulnerability
CVE-2022-43473
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-03-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-611
Description
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve
a malicious XML payload to trigger this vulnerability.
Affected configurations
• zohocorp manageengine opmanager (< 12.6)
• zohocorp manageengine opmanager 12.6
• zohocorp manageengine opmanager plus (< 12.6)
• zohocorp manageengine opmanager plus 12.6
• zohocorp manageengine opmanager msp (< 12.6)
• zohocorp manageengine opmanager msp 12.6
Related
Weakness · CWE (1)
- CWE-611 Improper Restriction of XML External Entity Reference weakness
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1685 Exploit, Third Party Advisory
- https://www.manageengine.com/itom/advisory/cve-2022-43473.html Patch, Vendor Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1685 Exploit, Third Party Advisory
- https://www.manageengine.com/itom/advisory/cve-2022-43473.html Patch, Vendor Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1685 www.talosintelligence.com