CVE-2022-43473
Summary
| CVE | CVE-2022-43473 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-03-30 17:15:00 UTC |
| Updated | 2023-11-07 03:53:00 UTC |
| Description | A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability. |
Risk And Classification
Problem Types: CWE-611
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Zohocorp | Manageengine Opmanager | All | All | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126000 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126001 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126002 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126004 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126005 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126100 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126101 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126102 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126103 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126104 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126107 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126108 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126109 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126110 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126113 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126114 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126115 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126116 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126117 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126118 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126119 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126120 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126121 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126122 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126130 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126131 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126132 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126134 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126135 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126136 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126139 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126141 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126147 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126148 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126149 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126150 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126151 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126154 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126155 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126162 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126163 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126164 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126165 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126166 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126167 | All | All |
| Application | Zohocorp | Manageengine Opmanager | 12.6 | build126168 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | All | All | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126001 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126002 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126100 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126103 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126104 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126107 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126113 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126117 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126119 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126122 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126139 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126140 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126141 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126154 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126155 | All | All |
| Application | Zohocorp | Manageengine Opmanager Msp | 12.6 | build126264 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | All | All | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126001 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126002 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126100 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126103 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126104 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126107 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126113 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126117 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126119 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126122 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126139 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126140 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126141 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126154 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126155 | All | All |
| Application | Zohocorp | Manageengine Opmanager Plus | 12.6 | build126264 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Updates - CVE-2022-43473 | ManageEngine OpManager | MISC | www.manageengine.com | |
| TALOS-2022-1685 || Cisco Talos Intelligence Group - Comprehensive Threat Intelligence | MISC | talosintelligence.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.