Read the docs
TI-2019-01524 Aliases CVE-2019-1903GHSA-gm7g-6h7x-rpgr

Cisco Security Manager XML Entity Expansion Vulnerability

Priority MEDIUM 49CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to a targeted system that contain references within XML entities. An exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02167 82nd percentileScored 2026-11-07
Fix Fixed Cisco Security Manager (Cisco): 4.14(0.131)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Security Managerbefore 4.14(0.131)4.14(0.131)Patch availableCNA
  • Cisco Security Manager VendorCisco Affected before 4.14(0.131) Fixed in 4.14(0.131) Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:security_manager:4.14:sp2:*:*:*:*:*:*4.14 sp2VulnerableCisco
  • cpe:2.3:a:cisco:security_manager:4.14:sp2:*:*:*:*:*:* Versions 4.14 sp2 Vulnerable ·Cisco

Remediation

  • Fix · CNA Cisco Security Manager (Cisco) Fixed in 4.14(0.131)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1903
  2. 2026-10-03 Alias added: GHSA-gm7g-6h7x-rpgr

References

Advisory 1

  • TI-2020-16493 Cisco Security Manager Java Deserialization Vulnerabilities CVSS 3.1CRITICAL 9.8
  • TI-2019-09430 Cisco Security Manager Java Deserialization Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2020-16492 Cisco Security Manager Path Traversal Vulnerability CVSS 3.1CRITICAL 9.1
  • TI-2009-01101 Directory traversal vulnerability in the TFTP service in Cisco CiscoWorks Common Services… CVSS 2.0HIGH 10.0
  • TI-2010-02906 Multiple buffer overflows in the authentication functionality in the web-server module in… CVSS 2.0HIGH 10.0
  • TI-2020-16487 Cisco Security Manager Static Credential Vulnerability CVSS 3.1CRITICAL 9.8
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences