6.5

CVE-2024-20531

Cisco Identity Services Engine XML External Entity Injection Vulnerability

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device and conduct a server-side request forgery (SSRF) attack through an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials.

This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing XML input. An attacker could exploit this vulnerability by sending a crafted API request to an affected device. A successful exploit could allow the attacker to read arbitrary files on the underlying operating system or conduct an SSRF attack through the affected device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Identity Services Engine Version 3.0.0 Update -
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch5
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch6
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch7
Cisco ≫ Identity Services Engine Version 3.0.0 Update patch8
Cisco ≫ Identity Services Engine Version 3.1.0 Update -
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch5
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch6
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch7
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch8
Cisco ≫ Identity Services Engine Version 3.1.0 Update patch9
Cisco ≫ Identity Services Engine Version 3.2.0 Update -
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch4
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch5
Cisco ≫ Identity Services Engine Version 3.2.0 Update patch6
Cisco ≫ Identity Services Engine Version 3.3.0 Update -
Cisco ≫ Identity Services Engine Version 3.3.0 Update patch1
Cisco ≫ Identity Services Engine Version 3.3.0 Update patch2
Cisco ≫ Identity Services Engine Version 3.3.0 Update patch3
Cisco ≫ Identity Services Engine Version 3.4.0 Update -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.35% 0.283
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 1.2 5.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Cisco PSIRT 5.5 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multi-vuln-DBQdWRy
Vendor Advisory