CVE-2022-43473
MEDIUM 5.4EPSS 19.8%
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.
- Affected
- ManageEngine · OpManager
- CVSS v3.1 NVD
- 5.4 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - CVSS v3.1 CISCO
- 5.8 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L - EPSS
- 19.81% chance of exploitation in the next 30 days, 97th percentile
- Published
- 2023-03-30
- Updated
- 2025-02-11