CVE-2018-0218: XEE

Published Mar 8, 2018

Updated

A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70616.

Affected Software

1 affected component

Cisco Secure Access Control Server Solution Engine=5.8\(0.8\)

Event History

Mar 8, 2018

CVE Published

via MITRE·07:00 AM

Data Sourced

via MITRE·07:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-0218?

CVE-2018-0218 has been classified as a high-severity vulnerability due to its potential to allow unauthorized access to sensitive information.

How do I fix CVE-2018-0218?

To fix CVE-2018-0218, upgrade to Cisco Secure Access Control Server version 5.8 patch 9 or later.

Who is affected by CVE-2018-0218?

CVE-2018-0218 affects users of Cisco Secure Access Control Server versions prior to 5.8 patch 9.

What type of attack does CVE-2018-0218 allow?

CVE-2018-0218 allows unauthenticated remote attackers to gain read access to certain information within the affected system.

What is the cause of CVE-2018-0218?

CVE-2018-0218 is caused by improper handling of XML External Entities (XXE) in the web-based user interface.