Cisco AnyConnect Profile Editor CVE-2018-0100 Local XML External Entity Injection Vulnerability

Bugtraq ID:	102738
Class:	Design Error
CVE:	CVE-2018-0100
Remote:	No
Local:	Yes
Published:	Jan 17 2018 12:00AM
Updated:	Jan 17 2018 12:00AM
Credit:	Alain Homewood of Insomnia Security
Vulnerable:	Cisco AnyConnect VPN Client Software 0 Cisco AnyConnect Secure Mobility Client 4.4(4030)
Not Vulnerable:

Cisco AnyConnect Profile Editor CVE-2018-0100 Local XML External Entity Injection Vulnerability

Cisco AnyConnect Profile Editor is prone to a local XML External Entity injection vulnerability because the application fails to properly handle external XML data.

Attackers can exploit this issue to obtain potentially sensitive information or perform unauthorized actions. This may lead to further attacks.

This issue is being tracked by Cisco Bug ID CSCvg19341.

Cisco AnyConnect Profile Editor CVE-2018-0100 Local XML External Entity Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco AnyConnect Profile Editor CVE-2018-0100 Local XML External Entity Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco AnyConnect Profile Editor CVE-2018-0100 Local XML External Entity Injection Vulnerability

References:

• Cisco Homepage (Cisco )
  
• cisco-sa-20180117-acpe: Cisco AnyConnect Profile Editor XML External Entity Inj (Cisco)