CVE-2018-0207

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. The vulnerability is due to improper handling of XML External Entities (XXEs) when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file. Cisco Bug IDs: CSCve70595.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-611

Affected software

Vendor	Product	Versions
n/a	Cisco Secure Access Control Server	Cisco Secure Access Control Server

References

http://www.securityfocus.com/bid/103343Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040470Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acsVendor Advisory
http://www.securityfocus.com/bid/103343Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040470Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acsVendor Advisory

Timeline

Published: Mar 8, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-02085.4A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allow an authenticated, r CVE-2018-02097.7A vulnerability in the Simple Network Management Protocol (SNMP) subsystem communication channel through the Cisco 550X Series Stackable Man CVE-2018-02108.8A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker t CVE-2018-02114.4A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a deni CVE-2018-02126.1A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke CVE-2018-02138.8A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker CVE-2018-02145.3A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to execute arbi CVE-2018-02156.3A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke CVE-2018-02165.4A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke CVE-2018-02176.7A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authen CVE-2018-02183.3A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticate CVE-2018-02196.1A vulnerability in the web-based management interface of Cisco Unified Computing System (UCS) Director could allow an unauthenticated, remot