CVE-2019-1903 Cisco Security Manager XML Entity Expansion Vulnerability
Unauthenticated remote attackers can exploit XML entity expansion to read local files or cause denial of service in Cisco Security Manager.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-1903?
CVE-2019-1903 is a medium-severity vulnerability in Cisco Security Manager, published on 20 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to a targeted system that contain references within XML entities. An exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition.
Weakness: CWE-611
Which versions are affected by CVE-2019-1903?
It affects 1 product.
Products include Cisco Security Manager.
How do I fix CVE-2019-1903?
No fix has been published for CVE-2019-1903 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-1903 being exploited?
There is no known exploitation of CVE-2019-1903 in the wild and no public exploit code.
Other vulnerabilities in Cisco Security Manager
Sources
Also known as GHSA-gm7g-6h7x-rpgr.