CVE-2021-34706: Cisco Identity Services Engine XML External Entity Injection Vulnerability
First published: Wed Oct 06 2021(Updated: )
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information or conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by uploading a crafted XML file that contains references to external entities. A successful exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the web application to perform arbitrary HTTP requests on behalf of the attacker.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Identity Services Engine | <=3.1 | |
| Cisco Identity Services Engine | =3.1\(0.518\) | |
| Cisco Identity Services Engine | =3.2\(0.149\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-34706?
CVE-2021-34706 is a vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE).
How does CVE-2021-34706 affect Cisco Identity Services Engine?
CVE-2021-34706 allows an authenticated, remote attacker to access sensitive information or conduct a server-side request forgery (SSRF) attack through an affected device.
What is the severity of CVE-2021-34706?
The severity of CVE-2021-34706 is medium, with a CVSS severity score of 5.4.
How can I fix CVE-2021-34706?
To fix CVE-2021-34706, Cisco recommends upgrading to a fixed version of Cisco Identity Services Engine (ISE) that addresses the vulnerability.
Where can I find more information about CVE-2021-34706?
You can find more information about CVE-2021-34706 in the Cisco Security Advisory at https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xxe-inj-V4VSjEsX.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/author
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/cisco
- canonical/cisco identity services engine
- version/cisco identity services engine/3.1
- version/cisco identity services engine/3.1\(0.518\)
- version/cisco identity services engine/3.2\(0.149\)