Lucene search

CiscoCVE-2018-0207

HistoryMar 08, 2018 - 7:29 a.m.

CVE-2018-0207

2018-03-0807:29:00

CWE-200

CWE-611

cisco

web.nvd.nist.gov

cisco

secure access control server

vulnerability

remote attack

read access

cve-2018-0207

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

61.2%

JSON

A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70595.

Affected configurations

Nvd

Node

ciscosecure_access_control_server_solution_engineMatch5.8\(0.8\)

VendorProductVersionCPE
ciscosecure_access_control_server_solution_engine5.8(0.8)cpe:2.3:a:cisco:secure_access_control_server_solution_engine:5.8\(0.8\):*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	secure_access_control_server_solution_engine	5.8(0.8)	cpe:2.3:a:cisco:secure_access_control_server_solution_engine:5.8\(0.8\):::::::*

CNA Affected

[
  {
    "product": "Cisco Secure Access Control Server",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Secure Access Control Server"
      }
    ]
  }
]

References

www.securityfocus.com/bid/103343

www.securitytracker.com/id/1040470

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

3.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.002

Percentile

61.2%

JSON

Related for CVE-2018-0207