A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information or conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by uploading a crafted XML file that contains references to external entities. A successful exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the web application to perform arbitrary HTTP requests on behalf of the attacker.
History

Fri, 08 Nov 2024 08:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2021-10-06T19:46:42.569823Z

Updated: 2024-11-07T21:48:09.582Z

Reserved: 2021-06-15T00:00:00

Link: CVE-2021-34706

cve-icon Vulnrichment

Updated: 2024-08-04T00:19:48.120Z

cve-icon NVD

Status : Modified

Published: 2021-10-06T20:15:09.047

Modified: 2024-11-21T06:11:00.600

Link: CVE-2021-34706

cve-icon Redhat

No data.