vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-43473

MEDIUM
5.4
CVSS Score
Published: March 30, 2023 at 04:28 PM UTC
Updated: June 17, 2026 at 05:06 AM UTC
4 products affected across 2 vendorsManageengine OpmanagerManageengine Opmanager PlusManageengine Opmanager Msp

Using OpManager by ManageEngine?

Get instant alerts when new vulnerabilities affect OpManager - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.4
Exploit prediction
EPSS 20%
SSVC
PoC

Description

A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168. A specially crafted XML file can lead to SSRF. An attacker can serve a malicious XML payload to trigger this vulnerability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Manageengine Opmanager· Zohocorp
95%
v < 12.612.6 build12600012.6 build12600112.6 build12600212.6 build12600412.6 build12600512.6 build12610012.6 build12610112.6 build12610212.6 build12610312.6 build12610412.6 build12610712.6 build12610812.6 build12610912.6 build12611012.6 build12611312.6 build12611412.6 build12611512.6 build12611612.6 build12611712.6 build12611812.6 build12611912.6 build12612012.6 build12612112.6 build12612212.6 build12613012.6 build12613112.6 build12613212.6 build12613412.6 build12613512.6 build12613612.6 build12613912.6 build12614112.6 build12614712.6 build12614812.6 build12614912.6 build12615012.6 build12615112.6 build12615412.6 build12615512.6 build12616212.6 build12616312.6 build12616412.6 build12616512.6 build12616612.6 build12616712.6 build126168
Affected range stops below 12.6, so it looks safe — our inference, not a vendor statement
Manageengine Opmanager Msp· Zohocorp
95%
v < 12.612.6 build12600112.6 build12600212.6 build12610012.6 build12610312.6 build12610412.6 build12610712.6 build12611312.6 build12611712.6 build12611912.6 build12612212.6 build12613912.6 build12614012.6 build12614112.6 build12615412.6 build12615512.6 build126264
Affected range stops below 12.6, so it looks safe — our inference, not a vendor statement
Manageengine Opmanager Plus· Zohocorp
95%
v < 12.612.6 build12600112.6 build12600212.6 build12610012.6 build12610312.6 build12610412.6 build12610712.6 build12611312.6 build12611712.6 build12611912.6 build12612212.6 build12613912.6 build12614012.6 build12614112.6 build12615412.6 build12615512.6 build126264
Affected range stops below 12.6, so it looks safe — our inference, not a vendor statement
OpManager· Manageengine
60%
12.6.168

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (3)

ExploitThird Party Advisory
Source: [email protected]
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1685
PatchVendor Advisory
Source: [email protected]
https://www.manageengine.com/itom/advisory/cve-2022-43473.html
Source: af854a3a-2127-422b-91ae-364da2661108
https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1685

SSVC — Action Prioritization

SSVCPoCNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.4MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-611

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card