CVE-2023-20030: Cisco Identity Services Engine XML External Entity Injection Vulnerability
First published: Wed Apr 05 2023(Updated: )
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information, conduct a server-side request forgery (SSRF) attack through an affected device, or negatively impact the responsiveness of the web-based management interface itself. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by uploading a crafted XML file that contains references to external entities. A successful exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of confidential information. A successful exploit could also cause the web application to perform arbitrary HTTP requests on behalf of the attacker or consume memory resources to reduce the availability of the web-based management interface. To successfully exploit this vulnerability, an attacker would need valid Super Admin or Policy Admin credentials.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Identity Services Engine | <3.2 | |
| Cisco Identity Services Engine | =3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco Identity Services Engine (ISE) vulnerability?
The vulnerability ID for this Cisco Identity Services Engine (ISE) vulnerability is CVE-2023-20030.
What is the severity of CVE-2023-20030?
The severity of CVE-2023-20030 is medium.
What can an attacker do with this vulnerability?
An authenticated, remote attacker could access sensitive information, conduct a server-side request forgery (SSRF) attack, or negatively impact the responsiveness of the affected device.
Which version of Cisco Identity Services Engine (ISE) is affected by this vulnerability?
Cisco Identity Services Engine (ISE) version 3.2 is affected by this vulnerability.
How can I fix CVE-2023-20030?
Cisco has released a security advisory with mitigation measures. Please refer to the Cisco Security Advisory for detailed instructions.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/last-modified-date
- agent/author
- agent/tags
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- vendor/cisco
- canonical/cisco identity services engine
- version/cisco identity services engine/3.2