60
CVE-2022-43473
PoC —CVSS 3.1
5.4 medium
EPSS
20%p97
Published
()
Modified
Description
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.
- Vendors
- zohocorp
- Products
- manageengine opmanager, manageengine opmanager plus, manageengine opmanager msp
- Weakness
- CWE-611
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N