Low severity · published Mar 8, 2018
CVE-2018-0218
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access…
3.3
CVSS
1.5%
EPSS
No
On KEV
Description
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70616.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Secure Access Control Server Solution Engine · Cisco
5.8(0.8) · source: NVD
Affected product
SA
Secure Access Control Server Solution Engine
Cisco
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-0218
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-0218
Third Party Advisory
http://www.securityfocus.com/bid/103345
Third Party Advisory
http://www.securitytracker.com/id/1040470
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs1
More from Secure Access Control Server Solution Engine
5.7
CVE-2018-0414
A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain information in an affected…
3.3
CVE-2018-0207
A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access…
–
CVE-2015-0700
Cross-site request forgery (CSRF) vulnerability in the Dashboard page in the monitoring-and-report section in Cisco Secure Access Control Server Solution Engine before 5.5(0.46.5)…
–
CVE-2013-3380
The administrative web interface in the Access Control Server in Cisco Secure Access Control System (ACS) does not properly restrict the report view page, which allows remote…