CVE-2023-20173
Assigner: cisco
Published: 2023-05-18T00:00:00
State: PUBLISHED
title: Cisco Identity Services Engine XML External Entity Injection Vulnerabilities
datePublic: 2023-05-17T00:00:00
descriptions: value: Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read arbitrary files or conduct a server-side request forgery (SSRF) attack through an affected device. To exploit these vulnerabilities, an attacker must have valid Administrator credentials on the affected device. For more information about these vulnerabilities, see the Details section of this advisory.
affected: vendor: Cisco
product: Cisco Identity Services Engine Software 
versions: version: n/a
status: affected
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
problemTypes: descriptions: type: CWE
description: CWE-611
cweId: CWE-611
source: advisory: cisco-sa-ise-xxe-inj-696OZTCm
defect: CSCwd38137
CSCwd93719
discovery: INTERNAL
exploits: value: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.