CVE-2021-1267: cisco cisco firepower management center XML Entity Expansion

Vulnerability summary

CVE-2021-1267 is a medium (CVSS 4.3) XML Entity Expansion vulnerability in cisco cisco firepower management center. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 62.8% of scored vulnerabilities.

Timeline

1. 13-01-2021
   PublishedVulnerability first disclosed.
2. 12-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the dashboard widget of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by crafting an XML-based widget on an affected server. A successful exploit could cause increased memory and CPU utilization, which could result in a DoS condition.

• CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.