CVE-2021-34706

Summary

CVE	CVE-2021-34706
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2021-10-06 20:15:00 UTC
Updated	2023-11-07 03:36:00 UTC
Description	A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access sensitive information or conduct a server-side request forgery (SSRF) attack through an affected device. This vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by uploading a crafted XML file that contains references to external entities. A successful exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the web application to perform arbitrary HTTP requests on behalf of the attacker.

Risk And Classification

Problem Types: CWE-611

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Cisco	Identity Services Engine	3.1\(0.518\)	All	All	All
Application	Cisco	Identity Services Engine	3.2\(0.149\)	All	All	All
Application	Cisco	Identity Services Engine	All	All	All	All

References

Reference	Source	Link	Tags
Cisco Identity Services Engine XML External Entity Injection Vulnerability	CISCO	tools.cisco.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

317070 Cisco Identity Services Engine (ISE) Extensible Markup Language (XML) External Entity Injection Vulnerability ( cisco-sa-ise-xxe-inj-V4VSjEsX)