CVE-2022-43473
medium · 5.8A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.
5.8
CVSS
19.8%
EPSS (exploit prob.)
97th
EPSS percentile
2023-03-30
Published
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Weaknesses
CWE-611
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| zohocorp | manageengine_opmanager | < 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
| zohocorp | manageengine_opmanager | 12.6 |
Check a specific version with /api/v1/cve/match.
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1685
- https://www.manageengine.com/itom/advisory/cve-2022-43473.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1685
- https://www.manageengine.com/itom/advisory/cve-2022-43473.html
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1685
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2022-43473