XML External Entity injection in Cisco Identity Services Engine (ISE) - CVE-2023-20174
Published: May 18, 2023
Vulnerability identifier: #VU76299
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2023-20174
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to compromise the target system.
The vulnerability exists due to insufficient validation of user-supplied XML input. A remote administrator can pass a specially crafted XML code to the affected application and send arbitrary network requests that are sourced from the affected system.
Affected software
Cisco Identity Services Engine (ISE)
How to mitigate CVE-2023-20174
Install updates from vendor's website.
Cisco Identity Services Engine (ISE) - update to 3.2P2