CVE-2024-20531: Cisco Identity Services Engine XML External Entity Injection Vulnerability
A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a server-side request forgery (SSRF) attack through an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing XML input. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read arbitrary files on the underlying operating system or conduct an SSRF attack through the affected device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20531?
CVE-2024-20531 has been classified as a critical vulnerability that allows remote authenticated attackers to read arbitrary files and perform SSRF attacks.
How do I fix CVE-2024-20531?
To remediate CVE-2024-20531, users should apply the latest patches released for Cisco Identity Services Engine versions affected by this vulnerability.
Which versions of Cisco Identity Services Engine are affected by CVE-2024-20531?
CVE-2024-20531 affects Cisco Identity Services Engine versions 3.0.0 through 3.4.0, including various patches.
What type of attack can be executed through CVE-2024-20531?
CVE-2024-20531 can be exploited to conduct server-side request forgery (SSRF) attacks on the affected device.
Who can exploit CVE-2024-20531?
Only authenticated remote attackers can exploit CVE-2024-20531 to read files on the underlying operating system.