CVE-2022-20938

Summary

A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to view sensitive information. This vulnerability is due to insufficient validation of the XML syntax when importing a module. An attacker could exploit this vulnerability by supplying a specially crafted XML file to the function. A successful exploit could allow the attacker to read sensitive data that would normally not be revealed.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Firepower Management Center6.2.3affected
CiscoCisco Firepower Management Center6.2.3.1affected
CiscoCisco Firepower Management Center6.2.3.2affected
CiscoCisco Firepower Management Center6.2.3.3affected
CiscoCisco Firepower Management Center6.2.3.4affected
CiscoCisco Firepower Management Center6.2.3.5affected
CiscoCisco Firepower Management Center6.2.3.6affected
CiscoCisco Firepower Management Center6.2.3.7affected
CiscoCisco Firepower Management Center6.2.3.9affected
CiscoCisco Firepower Management Center6.2.3.10affected
CiscoCisco Firepower Management Center6.2.3.11affected
CiscoCisco Firepower Management Center6.2.3.12affected
CiscoCisco Firepower Management Center6.2.3.13affected
CiscoCisco Firepower Management Center6.2.3.14affected
CiscoCisco Firepower Management Center6.2.3.15affected
CiscoCisco Firepower Management Center6.2.3.8affected
CiscoCisco Firepower Management Center6.2.3.16affected
CiscoCisco Firepower Management Center6.2.3.17affected
CiscoCisco Firepower Management Center6.2.3.18affected
CiscoCisco Firepower Management Center6.4.0affected
CiscoCisco Firepower Management Center6.4.0.1affected
CiscoCisco Firepower Management Center6.4.0.3affected
CiscoCisco Firepower Management Center6.4.0.2affected
CiscoCisco Firepower Management Center6.4.0.4affected
CiscoCisco Firepower Management Center6.4.0.5affected
CiscoCisco Firepower Management Center6.4.0.6affected
CiscoCisco Firepower Management Center6.4.0.7affected
CiscoCisco Firepower Management Center6.4.0.8affected
CiscoCisco Firepower Management Center6.4.0.9affected
CiscoCisco Firepower Management Center6.4.0.10affected
CiscoCisco Firepower Management Center6.4.0.11affected
CiscoCisco Firepower Management Center6.4.0.12affected
CiscoCisco Firepower Management Center6.4.0.13affected
CiscoCisco Firepower Management Center6.4.0.14affected
CiscoCisco Firepower Management Center6.4.0.15affected
CiscoCisco Firepower Management Center6.6.0affected
CiscoCisco Firepower Management Center6.6.0.1affected
CiscoCisco Firepower Management Center6.6.1affected
CiscoCisco Firepower Management Center6.6.3affected
CiscoCisco Firepower Management Center6.6.4affected
CiscoCisco Firepower Management Center6.6.5affected
CiscoCisco Firepower Management Center6.6.5.1affected
CiscoCisco Firepower Management Center6.6.5.2affected
CiscoCisco Firepower Management Center6.7.0affected
CiscoCisco Firepower Management Center6.7.0.1affected
CiscoCisco Firepower Management Center6.7.0.2affected
CiscoCisco Firepower Management Center6.7.0.3affected
CiscoCisco Firepower Management Center7.0.0affected
CiscoCisco Firepower Management Center7.0.0.1affected
CiscoCisco Firepower Management Center7.0.1affected
CiscoCisco Firepower Management Center7.0.1.1affected
CiscoCisco Firepower Management Center7.0.2affected
CiscoCisco Firepower Management Center7.0.2.1affected
CiscoCisco Firepower Management Center7.0.3affected
CiscoCisco Firepower Management Center7.0.4affected
CiscoCisco Firepower Management Center7.1.0affected
CiscoCisco Firepower Management Center7.1.0.1affected
CiscoCisco Firepower Management Center7.1.0.2affected

Weaknesses

  • CWE-611: Improper Restriction of XML External Entity Reference

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References