CVE-2018-0207CWE-200

A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker…

published March 8, 2018

CVSS
—
EPSS
1%
Percentile
73.7
In the wild
Unconfirmed
What it is

A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70595.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01485 · 73.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2018-03-08T07:00Z
EPSS history
Timeline
  • 08 MAR 07:00Z
    A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker…
    cvelistv5