VULNERABILITY INTELLIGENCE

CVE-2022-43473

CVSS score5.8 MEDIUM

EPSS probability19.81%

CISA KEVNot currently listed

Published2023-03-30

Last modified2026-06-17

Description

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.