CVE-2021-1483 — XML External Entity (XXE) Injection in Cisco Catalyst Sd-wan Manager

CWE-611 — XML External Entity (XXE) Injection4 documents4 sources
Severity
6.4MEDIUMNVD
EPSS
0.3%
top 49.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Catalyst Sd-wan ManagerCisco Catalyst Sd-wan Manager
Timeline
PublishedNov 15

Description

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. This vulnerability is due to improper handling of XML External Entity (XXE) entries when the affected software parses certain XML files. An attacker could exploit this vulnerability by persuading a user to import a crafted XML file with malicious entries. A successful exploit could allow the attacker to rea…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:NExploitability: 3.1 | Impact: 2.7

Affected Packages2 packages

▶NVDcisco/catalyst_sd-wan_manager62 versions+61
▶CVEListV5cisco/cisco_catalyst_sd-wan_manager62 versions+61

🔴Vulnerability Details

2
CVEList
Cisco SD-WAN vManage Software XML External Entity Vulnerability↗2024-11-15
▶
GHSA
GHSA-4789-39gm-mc98: A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to informat↗2024-11-15
▶

📋Vendor Advisories

1
Cisco
Cisco SD-WAN vManage XML External Entity Vulnerability↗2021-04-21
▶
CVE-2021-1483 — XML External Entity (XXE) Injection | cvebase