cisco-sa-20190619-csm-xml: Cisco Security Manager XML Entity Expansion Vulnerability
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition.
The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to a targeted system that contain references within XML entities. An exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition. There are no workarounds that address this vulnerability.
This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-csm-xml
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20190619-csm-xml?
The severity of cisco-sa-20190619-csm-xml is considered high due to the potential for sensitive information exposure and denial of service.
How do I fix cisco-sa-20190619-csm-xml?
To fix cisco-sa-20190619-csm-xml, update your Cisco Security Manager to the latest version provided by Cisco.
What type of attack can exploit cisco-sa-20190619-csm-xml?
cisco-sa-20190619-csm-xml can be exploited by unauthenticated remote attackers leveraging improper restrictions on XML entities.
What systems are affected by cisco-sa-20190619-csm-xml?
The affected systems include Cisco Security Manager software versions that are vulnerable to this particular flaw.
Is there a workaround for cisco-sa-20190619-csm-xml?
There are no specific workarounds mentioned for cisco-sa-20190619-csm-xml, so applying the update is recommended.