PT-2019-2556 · Cisco · Cisco Security Manager

Publicado 2019-06-19 · Atualizado 2019-10-09 · CVE-2019-1903

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Security Manager (affected versions not specified)

Description A vulnerability could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The issue is due to improper restrictions on XML entities. An attacker could exploit this by sending malicious requests to a targeted system that contain references within XML entities. This could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2019-02408

CVE-2019-1903

Produtos afetados

Cisco Security Manager

Referências · 7

• https://bdu.fstec.ru/vul/2019-02408 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1903 · Nota de Segurança
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&last_published=2019+Jun&sort=-day_sir&limit=50#~Vulnerabilities · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-csm-xml · Aviso do Fabricante
• https://tools.cisco.com/security/center/publicationListing.x?product=Cisco&last_published=2019+Jun&sort=-day_sir&limit=50#~Vulnerabilities · Nota
• http://securityfocus.com/bid/108857 · Nota
• https://osv.dev/vulnerability/CVE-2019-1903 · Aviso do Fabricante