description: A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to view sensitive information.
This vulnerability is due to insufficient validation of the XML syntax when importing a module. An attacker could exploit this vulnerability by supplying a specially crafted XML file to the function. A successful exploit could allow the attacker to read sensitive data that would normally not be revealed.
problem types: Improper Restriction of XML External Entity Reference
affected:
{
vendor: Cisco
product: Cisco Firepower Management Center
versions:
version: 6.2.3, status: affected
version: 6.2.3.1, status: affected
version: 6.2.3.2, status: affected
version: 6.2.3.3, status: affected
version: 6.2.3.4, status: affected
version: 6.2.3.5, status: affected
version: 6.2.3.6, status: affected
version: 6.2.3.7, status: affected
version: 6.2.3.9, status: affected
version: 6.2.3.10, status: affected
version: 6.2.3.11, status: affected
version: 6.2.3.12, status: affected
version: 6.2.3.13, status: affected
version: 6.2.3.14, status: affected
version: 6.2.3.15, status: affected
version: 6.2.3.8, status: affected
version: 6.2.3.16, status: affected
version: 6.2.3.17, status: affected
version: 6.2.3.18, status: affected
version: 6.4.0, status: affected
version: 6.4.0.1, status: affected
version: 6.4.0.3, status: affected
version: 6.4.0.2, status: affected
version: 6.4.0.4, status: affected
version: 6.4.0.5, status: affected
version: 6.4.0.6, status: affected
version: 6.4.0.7, status: affected
version: 6.4.0.8, status: affected
version: 6.4.0.9, status: affected
version: 6.4.0.10, status: affected
version: 6.4.0.11, status: affected
version: 6.4.0.12, status: affected
version: 6.4.0.13, status: affected
version: 6.4.0.14, status: affected
version: 6.4.0.15, status: affected
version: 6.6.0, status: affected
version: 6.6.0.1, status: affected
version: 6.6.1, status: affected
version: 6.6.3, status: affected
version: 6.6.4, status: affected
version: 6.6.5, status: affected
version: 6.6.5.1, status: affected
version: 6.6.5.2, status: affected
version: 6.7.0, status: affected
version: 6.7.0.1, status: affected
version: 6.7.0.2, status: affected
version: 6.7.0.3, status: affected
version: 7.0.0, status: affected
version: 7.0.0.1, status: affected
version: 7.0.1, status: affected
version: 7.0.1.1, status: affected
version: 7.0.2, status: affected
version: 7.0.2.1, status: affected
version: 7.0.3, status: affected
version: 7.0.4, status: affected
version: 7.1.0, status: affected
version: 7.1.0.1, status: affected
version: 7.1.0.2, status: affected
}
metrics:
format: cvssV3_1
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 4.3
baseSeverity: MEDIUM
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
]
exploits: The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.