A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve
a malicious XML payload to trigger this vulnerability.
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact Low
Integrity Impact Low
Availability Impact None
User Interaction Required
No CVSS v3.0
No CVSS v2
Vendors | Products |
---|---|
Zohocorp |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
Configuration 3 [-]
|
References
Link | Resource |
---|---|
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1685 | Exploit Third Party Advisory |
https://www.manageengine.com/itom/advisory/cve-2022-43473.html | Patch Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: talos
Published: 2023-03-30T16:28:35.983Z
Updated: 2023-03-30T16:28:35.983Z
Reserved: 2022-12-05T20:53:36.058Z
Link: CVE-2022-43473
JSON object: View
NVD Information
Status : Modified
Published: 2023-03-30T17:15:06.750
Modified: 2023-11-07T03:53:49.523
Link: CVE-2022-43473
JSON object: View
Redhat Information
No data.
CWE