{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2020-26064", "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "state": "PUBLISHED", "assignerShortName": "cisco", "dateReserved": "2020-09-24T00:00:00.000Z", "datePublished": "2023-08-04T20:52:31.662Z", "dateUpdated": "2024-08-04T15:49:06.698Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco", "dateUpdated": "2024-01-25T16:57:03.835Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system.\r\n The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by persuading a user to import a crafted XML file with malicious entries. A successful exploit could allow the attacker to read and write files within the affected application."}], "affected": [{"vendor": "Cisco", "product": "Cisco SD-WAN vManage", "versions": [{"version": "17.2.6", "status": "affected"}, {"version": "17.2.7", "status": "affected"}, {"version": "17.2.8", "status": "affected"}, {"version": "17.2.9", "status": "affected"}, {"version": "17.2.10", "status": "affected"}, {"version": "17.2.4", "status": "affected"}, {"version": "17.2.5", "status": "affected"}, {"version": "18.3.1.1", "status": "affected"}, {"version": "18.3.3.1", "status": "affected"}, {"version": "18.3.3", "status": "affected"}, {"version": "18.3.4", "status": "affected"}, {"version": "18.3.5", "status": "affected"}, {"version": "18.3.7", "status": "affected"}, {"version": "18.3.8", "status": "affected"}, {"version": "18.3.6.1", "status": "affected"}, {"version": "18.3.1", "status": "affected"}, {"version": "18.3.0", "status": "affected"}, {"version": "18.4.0.1", "status": "affected"}, {"version": "18.4.3", "status": "affected"}, {"version": "18.4.302", "status": "affected"}, {"version": "18.4.303", "status": "affected"}, {"version": "18.4.4", "status": "affected"}, {"version": "18.4.5", "status": "affected"}, {"version": "18.4.0", "status": "affected"}, {"version": "18.4.1", "status": "affected"}, {"version": "19.2.0", "status": "affected"}, {"version": "19.2.097", "status": "affected"}, {"version": "19.2.099", "status": "affected"}, {"version": "19.2.1", "status": "affected"}, {"version": "19.2.2", "status": "affected"}, {"version": "19.2.3", "status": "affected"}, {"version": "19.2.31", "status": "affected"}, {"version": "19.2.929", "status": "affected"}, {"version": "20.1.1.1", "status": "affected"}, {"version": "20.1.12", "status": "affected"}, {"version": "20.1.1", "status": "affected"}, {"version": "19.3.0", "status": "affected"}, {"version": "19.1.0", "status": "affected"}, {"version": "18.2.0", "status": "affected"}, {"version": "20.3.1", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Restriction of XML External Entity Reference", "type": "cwe", "cweId": "CWE-611"}]}], "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx2-KpFVSUc", "name": "cisco-sa-vmanx2-KpFVSUc"}], "metrics": [{"format": "cvssV3_0", "cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "exploits": [{"lang": "en", "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."}], "source": {"advisory": "cisco-sa-vmanx2-KpFVSUc", "discovery": "EXTERNAL", "defects": ["CSCvv02305"]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T15:49:06.698Z"}, "title": "CVE Program Container", "references": [{"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx2-KpFVSUc", "name": "cisco-sa-vmanx2-KpFVSUc", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "A0D5F32C-BFC1-49CC-BE96-920FCBE567B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "F621202C-3851-4D7E-BFA2-DABB08E73DB6", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "38132BE5-528B-472E-9249-B226C0DE1C80", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "37C817B2-DDB9-4CAF-96C9-776482A8597D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.8:*:*:*:*:*:*:*", "matchCriteriaId": "AC5D29FD-0917-4C1F-AE75-2D63F5C9C58D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.9:*:*:*:*:*:*:*", "matchCriteriaId": "1E3090C4-15E6-4746-B0D2-27665AB91B08", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:17.2.10:*:*:*:*:*:*:*", "matchCriteriaId": "04E924CC-3161-436D-93F0-066F76172F55", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "7ED059CD-AD0A-4748-8390-8CDCF4C4D1CC", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "6990E97D-30E9-42A9-AE6A-CC597DF75B0B", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "15B60BA4-EA02-4D0D-82C3-1B08016EF5AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "E9DC51F7-72D4-4593-8DDE-8AA3955BB826", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "B047A011-1C27-4D86-99C1-BFCDC7F04A9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "DADEA8FB-3298-4534-B65E-81060E3DB45A", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "F4C6DF1F-4995-4486-8F90-9EFD6417ABA6", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "6D249954-93E0-4124-B9BA-84B9F34D7CB1", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "B7F20EBE-DFDF-4996-93D1-28EE776BC777", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.7:*:*:*:*:*:*:*", "matchCriteriaId": "3DF09CAB-CA1B-428E-9A0B-AADACE9201A0", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "D99ED480-C206-48DD-9DF3-FC60D91B98A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "4DC515B6-27A3-4723-9792-2BA42EF63E44", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "DEC0BBDA-FAE5-4AF7-81C8-83041A58E8E7", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "7A066E28-31B0-46C7-ABB8-F5D1F3A303C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "C8F536CC-29D6-401E-92C5-964FDBDCCE65", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.4:*:*:*:*:*:*:*", "matchCriteriaId": "9139593A-9414-488D-AA3A-5560C643587D", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.5:*:*:*:*:*:*:*", "matchCriteriaId": "07BFB47E-F456-4782-98D7-68D02500FDD3", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.302:*:*:*:*:*:*:*", "matchCriteriaId": "33BEBE47-AF47-4994-871D-5969270EE5AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:18.4.303:*:*:*:*:*:*:*", "matchCriteriaId": "A27094E7-E6F3-47CA-A90A-86FEA2F1BE33", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "6D6D47A0-43A2-4F9F-830B-B2FB79E779A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "87E7B932-950A-4573-832F-8477FABA5929", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "A1711A70-5931-4C1F-B522-46AD2E5D7C51", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "FE41B8AE-8F1E-4116-BDDC-65B913AD448E", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "7EC80219-C760-4CA8-B360-7B6545F502C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.31:*:*:*:*:*:*:*", "matchCriteriaId": "F9E425CF-5773-4C17-B284-588DDCE8DE43", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.097:*:*:*:*:*:*:*", "matchCriteriaId": "34886EDF-1C10-4F57-A82D-FF1AF668E2C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.099:*:*:*:*:*:*:*", "matchCriteriaId": "1D7B3B10-6936-4352-9EE7-561BB1918769", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.2.929:*:*:*:*:*:*:*", "matchCriteriaId": "1EB69F8B-67CB-4296-893A-7A35B155EBEA", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:19.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "491BD04C-85BE-4766-9965-59744D2639CE", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "545F75A3-451C-4993-98AE-51C23EF49927", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.1.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "1BB0DD6B-6C4D-4FF4-97AB-815A4566320F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.1.12:*:*:*:*:*:*:*", "matchCriteriaId": "482DC851-7E33-4487-8219-6675091FD7C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:catalyst_sd-wan_manager:20.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "BAFBFE36-6913-4122-A537-F2AA1562FE69", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system.\r\n The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by persuading a user to import a crafted XML file with malicious entries. A successful exploit could allow the attacker to read and write files within the affected application."}], "id": "CVE-2020-26064", "lastModified": "2024-01-25T17:15:13.730", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "ykramarz@cisco.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-08-04T21:15:09.580", "references": [{"source": "ykramarz@cisco.com", "tags": ["Vendor Advisory"], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanx2-KpFVSUc"}], "sourceIdentifier": "ykramarz@cisco.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-611"}], "source": "ykramarz@cisco.com", "type": "Secondary"}]}

{}