CVE-2022-43473
Published: 30 March 2023
Summary
CVE-2022-43473 is a medium-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Zohocorp Manageengine Opmanager. Its CVSS base score is 5.8 (Medium).
Operationally, ranked in the top 3.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A blind XML External Entity vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager version 12.6.168. The flaw, tracked as CWE-611, allows a specially crafted XML file to trigger server-side request forgery when processed by the application.
An unauthenticated remote attacker can supply a malicious XML payload to the affected component, achieving limited impact on confidentiality, integrity, and availability with changed scope. The reported CVSS 3.1 score is 5.8, reflecting the network attack vector, high attack complexity, and required user interaction.
Public advisories from ManageEngine and detailed analysis from Talos Intelligence are available at the listed references and address remediation steps for the affected product.
EPSS values reached a peak of 0.3557 after disclosure before settling at the current 0.2963, indicating a material rise in exploitation interest that warrants renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-46474
Vulnerability details
A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.