PT-2020-3127 · Cisco · Cisco Sd-Wan Vmanage

Johnny Yu · Published 2020-07-15 · Updated 2020-07-23 · CVE-2020-3405

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN vManage Software (affected versions not specified)

Description The issue is related to the improper restriction of XML external entity references in the web interface of Cisco SD-WAN vManage Software. This could allow a remote attacker to gain unauthorized access to protected information. The vulnerability is due to the improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this by persuading a user to import a crafted XML file with malicious entries, potentially allowing the attacker to read and write files within the affected application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2020-03419

CVE-2020-3405

Affected Products

Cisco Sd-Wan Vmanage

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanxml-Aj4GFEKd · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3405 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3405 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03419 · Security Note