CVE-2020-26064 — XML External Entity (XXE) Injection in Cisco Sd-wan Vmanage

CWE-611 — XML External Entity (XXE) Injection4 documents4 sources
Severity
8.1HIGHNVD
EPSS
0.1%
top 73.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Sd-wan VmanageCisco Catalyst Sd-wan Manager
Timeline
PublishedAug 4

Description

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by persuading a user to import a crafted XML file with malicious entries. A successful exploit could allow the attacker to read and write files with…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5cisco/cisco_sd-wan_vmanage40 versions+39
▶NVDcisco/catalyst_sd-wan_manager40 versions+39

🔴Vulnerability Details

2
CVEList
CVE-2020-26064: A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to informat↗2023-08-04
▶
GHSA
GHSA-rvrv-6xrw-v985: A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to informat↗2023-08-04
▶

📋Vendor Advisories

1
Cisco
Cisco SD-WAN vManage Software XML External Entity Vulnerability↗2020-11-04
▶
CVE-2020-26064 — XML External Entity (XXE) Injection | cvebase