CVSS 8.6 · High EPSS 1,1%
Kerentanan Improper Input Validation pada cisco catalyst sd-wan manager. Skor CVSS 3.1 8.6 (High) menurut cisco.com.
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, remote attacker to read arbitrary files that are stored in an affected system. The attacker does not need to have valid user credentials. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by sending a crafted request to an affected system. A successful exploit could allow the attacker to read arbitrary files that are stored in the affected system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| cisco | catalyst sd-wan manager | Semua versi sebelum 20.9.9.1 |
| cisco | catalyst sd-wan manager | Versi 20.10 hingga sebelum 20.12.5.4 |
| cisco | catalyst sd-wan manager | Versi 20.12.6 hingga sebelum 20.12.6.2 |
| cisco | catalyst sd-wan manager | Versi 20.13 hingga sebelum 20.15.4.4 |
| cisco | catalyst sd-wan manager | Versi 20.15.5 hingga sebelum 20.15.5.2 |
| cisco | catalyst sd-wan manager | Versi 20.16 hingga sebelum 20.18.2.2 |
| cisco | catalyst sd-wan manager | Versi 26.1 hingga sebelum 26.1.1.1 |
| cisco | catalyst sd-wan manager | Versi 20.12.7 |