CVE-2022-43473

Published: Mar 30, 2023Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: NVD

Description

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.

Affected (81)

Products: Zohocorp: Manageengine Opmanager, Manageengine Opmanager Plus, Manageengine Opmanager Msp

Zohocorp

3 products

Manageengine Opmanager

Manageengine Opmanager Plus

Manageengine Opmanager Msp

Configuration A

47 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Opmanager	Before 12.6
Zohocorp Manageengine Opmanager	Version 12.6 build126000
Zohocorp Manageengine Opmanager	Version 12.6 build126001
Zohocorp Manageengine Opmanager	Version 12.6 build126002
Zohocorp Manageengine Opmanager	Version 12.6 build126004
Zohocorp Manageengine Opmanager	Version 12.6 build126005
Zohocorp Manageengine Opmanager	Version 12.6 build126100
Zohocorp Manageengine Opmanager	Version 12.6 build126101
Zohocorp Manageengine Opmanager	Version 12.6 build126102
Zohocorp Manageengine Opmanager	Version 12.6 build126103
Zohocorp Manageengine Opmanager	Version 12.6 build126104
Zohocorp Manageengine Opmanager	Version 12.6 build126107
Zohocorp Manageengine Opmanager	Version 12.6 build126108
Zohocorp Manageengine Opmanager	Version 12.6 build126109
Zohocorp Manageengine Opmanager	Version 12.6 build126110
Zohocorp Manageengine Opmanager	Version 12.6 build126113
Zohocorp Manageengine Opmanager	Version 12.6 build126114
Zohocorp Manageengine Opmanager	Version 12.6 build126115
Zohocorp Manageengine Opmanager	Version 12.6 build126116
Zohocorp Manageengine Opmanager	Version 12.6 build126117
Zohocorp Manageengine Opmanager	Version 12.6 build126118
Zohocorp Manageengine Opmanager	Version 12.6 build126119
Zohocorp Manageengine Opmanager	Version 12.6 build126120
Zohocorp Manageengine Opmanager	Version 12.6 build126121
Zohocorp Manageengine Opmanager	Version 12.6 build126122
Zohocorp Manageengine Opmanager	Version 12.6 build126130
Zohocorp Manageengine Opmanager	Version 12.6 build126131
Zohocorp Manageengine Opmanager	Version 12.6 build126132
Zohocorp Manageengine Opmanager	Version 12.6 build126134
Zohocorp Manageengine Opmanager	Version 12.6 build126135
Zohocorp Manageengine Opmanager	Version 12.6 build126136
Zohocorp Manageengine Opmanager	Version 12.6 build126139
Zohocorp Manageengine Opmanager	Version 12.6 build126141
Zohocorp Manageengine Opmanager	Version 12.6 build126147
Zohocorp Manageengine Opmanager	Version 12.6 build126148
Zohocorp Manageengine Opmanager	Version 12.6 build126149
Zohocorp Manageengine Opmanager	Version 12.6 build126150
Zohocorp Manageengine Opmanager	Version 12.6 build126151
Zohocorp Manageengine Opmanager	Version 12.6 build126154
Zohocorp Manageengine Opmanager	Version 12.6 build126155
Zohocorp Manageengine Opmanager	Version 12.6 build126162
Zohocorp Manageengine Opmanager	Version 12.6 build126163
Zohocorp Manageengine Opmanager	Version 12.6 build126164
Zohocorp Manageengine Opmanager	Version 12.6 build126165
Zohocorp Manageengine Opmanager	Version 12.6 build126166
Zohocorp Manageengine Opmanager	Version 12.6 build126167
Zohocorp Manageengine Opmanager	Version 12.6 build126168

Configuration B

17 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Opmanager Plus	Before 12.6
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126001
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126002
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126100
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126103
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126104
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126107
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126113
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126117
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126119
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126122
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126139
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126140
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126141
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126154
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126155
Zohocorp Manageengine Opmanager Plus	Version 12.6 build126264

Configuration C

17 vulnerable

Vulnerable Software	Affected Versions
Zohocorp Manageengine Opmanager Msp	Before 12.6
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126001
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126002
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126100
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126103
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126104
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126107
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126113
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126117
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126119
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126122
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126139
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126140
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126141
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126154
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126155
Zohocorp Manageengine Opmanager Msp	Version 12.6 build126264