CVE-2018-0218 | BDVDB-2026-97521 Detail

Cisco Secure Access Control Server

Description#

A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70616.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References#

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs1
http://www.securityfocus.com/bid/103345
http://www.securitytracker.com/id/1040470

Exploit#

No public exploit known

History#

Version 12018-03-08Record published in the CVE List.
Version 22024-12-02Most recent update recorded in the CVE List.