Xxe

2023-03-3017:15:00

PRIOn knowledge base

www.prio-n.com

xml

external entity

ssrf

manageengine opmanager

0.006 Low

EPSS

Percentile

79.1%

JSON

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.

CPENameOperatorVersion
manageengine_opmanagereq12.6 build126113
manageengine_opmanagereq12.6 build126114
manageengine_opmanagereq12.6 build126115
manageengine_opmanagereq12.6 build126116
manageengine_opmanagereq12.6 build126117
manageengine_opmanagereq12.6 build126100
manageengine_opmanagereq12.6 build126101
manageengine_opmanagereq12.6 build126102
manageengine_opmanagereq12.6 build126103
manageengine_opmanagereq12.6 build126000

Name	Operator	Version
manageengine_opmanager	eq	12.6 build126113
manageengine_opmanager	eq	12.6 build126114
manageengine_opmanager	eq	12.6 build126115
manageengine_opmanager	eq	12.6 build126116
manageengine_opmanager	eq	12.6 build126117
manageengine_opmanager	eq	12.6 build126100
manageengine_opmanager	eq	12.6 build126101
manageengine_opmanager	eq	12.6 build126102
manageengine_opmanager	eq	12.6 build126103
manageengine_opmanager	eq	12.6 build126000