CVE-2022-20938CWE-611

A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated…

Medium · published November 10, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
46.9
In the wild
Unconfirmed
What it is

A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to view sensitive information.

This vulnerability is due to insufficient validation of the XML syntax when importing a module. An attacker could exploit this vulnerability by supplying a specially crafted XML file to the function. A successful exploit could allow the attacker to read sensitive data that would normally not be revealed.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00578 · 46.9th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2022-11-10T17:42Z
EPSS history
Timeline
  • 10 NOV 17:42Z
    A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated…
    cvelistv5