title: Cisco Firepower Threat Defense Software XML Injection Vulnerability
description: A vulnerability in CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject XML into the command parser. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by including crafted input in commands. A successful exploit could allow the attacker to inject XML into the command parser, which could result in unexpected processing of the command and unexpected command output.
problem types: CWE-91
affected:
{
product: Cisco Firepower Threat Defense Software
vendor: Cisco
versions:
status: affected, version: n/a
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
]
exploits: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.