CVE-2022-43473

MEDIUM 5.4CVE-2022-43473 · Published 30/03/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
manageengine opmanager zohocorp	`= 12.6< 12.6`	`12.6`
manageengine opmanager msp zohocorp	`= 12.6< 12.6`	`12.6`
manageengine opmanager plus zohocorp	`= 12.6< 12.6`	`12.6`

Description

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.

References

talosintelligence.com/vulnerability_reports/TALOS-2022-1685 · Exploit
manageengine.com/itom/advisory/cve-2022-43473.html · Patch
talosintelligence.com/vulnerability_reports/TALOS-2022-1685

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free