CVE-2022-43473

2023-03-3017:15:06

CWE-611

[email protected]

web.nvd.nist.gov

cve-2022-43473

xxe vulnerability

manageengine opmanager

ssrf

xml

nvd

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

5.3 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

79.1%

JSON

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve
a malicious XML payload to trigger this vulnerability.

Affected configurations

Vulners

NVD

Node

manageengineopmanagerRange≤12.6.168

VendorProductVersionCPE
manageengineopmanager*cpe:2.3:a:manageengine:opmanager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
manageengine	opmanager	*	cpe:2.3:a:manageengine:opmanager::::::::

CNA Affected

[
  {
    "vendor": "ManageEngine",
    "product": "OpManager",
    "versions": [
      {
        "version": " 12.6.168",
        "status": "affected"
      }
    ]
  }
]