Skip to content
fr Sign in
6.5 Medium

CVE-2020-26064 A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain…

Description

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by persuading a user to import a crafted XML file with malicious entries. A successful exploit could allow the attacker to read and write files within the affected application.

Affected products and versions

Product Affected versions Fixed in
Cisco SD-WAN vManage 20.3.1 No fix stated
Cisco SD-WAN vManage 20.1 20.1.1 → 20.1.12 No fix stated
Cisco SD-WAN vManage 19.3.0 No fix stated
Cisco SD-WAN vManage 19.2 19.2.0 → 19.2.929 No fix stated
Cisco SD-WAN vManage 19.1.0 No fix stated
Cisco SD-WAN vManage 18.4 18.4.0 → 18.4.303 No fix stated
Cisco SD-WAN vManage 18.3 18.3.0 → 18.3.8 No fix stated
Cisco SD-WAN vManage 18.2.0 No fix stated
Cisco SD-WAN vManage 17.2 17.2.4 → 17.2.10 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cisco SD-WAN vManage

The 61 CVEs of Cisco SD-WAN vManage →
CVE-2023-20261 A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve… 6.5 Medium CVE-2023-20179 A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage,… 4.3 Medium CVE-2023-20252 A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could… 9.8 Critical CVE-2023-20262 A vulnerability in the SSH service of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to… 5.3 Medium
Track this CVE