XXE in Cisco Security Manager
CVE-2019-1903
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to a targeted system that contain references within XML entities. An exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition.
Vulnerability class: XXE (XML External Entity)
EPSS: 0.022 (81.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L.
Affected products
- Cisco Security Manager — versions unspecified
- Cisco Security_manager — versions 4.14
Weakness classification (CWE)
References
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2019-1903?
- CVE-2019-1903 is a medium-severity vulnerability in Cisco Security Manager, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.5/10. Published 2019-06-20.
- How severe is CVE-2019-1903?
- Medium severity. CVSS v3 base score is 6.5 out of 10.